auren-research/cyber-sec huggingface dataset:
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.
High
High

1
Explore
[Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data.
Use an automated tool to record all instances of URLs to process requests from serialized data.
Use a browser to manually explore the website and analyze how the application processes requests using serialized data.

2
Exploit
[Launch a Blowup attack] The attacker crafts malicious messages that contain multiple configuration parameters in the same dataset.
Send the malicious crafted message containing the multiple configuration parameters to the target URL, causing a denial of service.

The server accepts input in the form of serialized data and is using a parser with a runtime longer than O(n) for the insertion of a new configuration parameter in the data container.(examples are .NET framework 1.0 and 1.1)

This attack may be mitigated completely by using a parser that is not using a vulnerable container.
Mitigation may limit the number of configuration parameters per dataset.

In this example, assume that the victim is running a vulnerable parser such as .NET framework 1.0. This results in a quadratic runtime of O(n^2).
<?xml version="1.0"?><fooaaa=""ZZZ=""...999=""/>
A document with n attributes results in (n^2)/2 operations to be performed. If an operation takes 100 nanoseconds then a document with 100,000 operations would take 500s to process. In this fashion a small message of less than 1MB causes a denial of service condition on the CPU resources.

A YAML bomb leverages references within a YAML file to create exponential growth in memory requirements. By creating a chain of keys whose values are a list of multiple references to the next key in the chain, the amount of memory and processing required to handle the data grows exponentially. This may lead to denial of service or instability resulting from excessive resource consumption.

41
XML Attribute Blowup

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Activation_Zone, Attack_Phases, Description, Description Summary, Examples-Instances, Injection_Vector, Methods_of_Attack, Payload, Related_Attack_Patterns, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated @Name, Description, Example_Instances, Execution_Flow, Mitigations, Prerequisites

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Example_Instances

XML Attribute Blowup
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

1548
Abuse Elevation Control Mechanism

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Description, Description Summary, Relationships, Type (Category -> Attack_Pattern)

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Weaknesses, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated @Abstraction
An adversary gains control of a process that is assigned elevated privileges in order to execute arbitrary code with those privileges. Some processes are assigned elevated privileges on an operating system, usually through association with a particular user, group, or role. If an attacker can hijack this process, they will be able to assume its level of privilege in order to execute their own code.
Medium

1
Explore
[Find process with elevated priveleges] The adversary probes for processes running with elevated privileges.
On Windows, use the process explorer's security tab to see if a process is running with administror privileges.
On Linux, use the ps command to view running processes and pipe the output to a search for a particular user, or the root user.

2
Experiment
[Find vulnerability in running process] The adversary looks for a vulnerability in the running process that would allow for arbitrary code execution with the privilege of the running process.
Look for improper input validation
Look for a buffer overflow which may be exploited if an adversary can inject unvalidated data.
Utilize system utilities that support process control that have been inadequately secured

3
Exploit
[Execute arbitrary code] The adversary exploits the vulnerability that they have found and hijacks the running process.

The targeted process or operating system must contain a bug that allows attackers to hijack the targeted process.

None: No specialized resources are required to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Description, Execution_Flow, Related_Attack_Patterns
This attack pattern has been deprecated. Please refer to CAPEC:30 - Hijacking a Privileged Thread of Execution.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary, Related_Attack_Patterns

Implementing a callback to system routine (old AWT Queue)
This attack pattern has been deprecated as it did not have enough distinction from CAPEC-30 : Hijacking a Privileged Thread of Execution. Please refer to CAPEC-30 moving forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Execution_Flow

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated @Name, @Status, Consequences, Description, Example_Instances, Execution_Flow, Likelihood_Of_Attack, Mitigations, Prerequisites, Related_Attack_Patterns, Related_Weaknesses, Resources_Required, Skills_Required, Typical_Severity

Catching exception throw/signal from privileged block
This attack pattern has been deprecated as it did not contain any content and did not serve any useful purpose. Please refer to "CAPEC-207: removing Important Client Functionality" going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated @Name, @Status, Description, Related_Attack_Patterns

Subversion of authorization checks: cache filtering, programmatic security, etc.
Subversion of Authorization Checks: Cache Filtering, Programmatic Security, etc.
An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.
High
High

The target application allows the user to both specify the identifier used to access a system resource. Through this permission, the user gains the capability to perform actions on that resource (e.g., overwrite the file)

Confidentiality
Read Data

Integrity
Modify Data

Ensure all input content that is delivered to client is sanitized against an acceptable content specification.
Perform input validation for all content.
Enforce regular patching of software.

Resource Injection

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Description, Description Summary

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Related_Weaknesses, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings
This attack pattern has been deprecated as it is a duplicate of the existing attack pattern "CAPEC-242 : Code Injection". Please refer to this other CAPEC going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Description, Description Summary

Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
High
High

The target software does not validate user-controlled input such that the execution of a process may be altered by sending code in through legitimate data channels, using no other mechanism.

Confidentiality
Integrity
Availability
Other
Code Injection attack patterns can result in a wide variety of consequences and negatively affect all three elements of the security triad.

Utilize strict type, character, and encoding enforcement
Ensure all input content that is delivered to client is sanitized against an acceptable content specification.
Perform input validation for all content.
Enforce regular patching of software.

Code Injection

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Related_Weaknesses, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References, Taxonomy_Mappings
This pattern has been deprecated as it is covered by a chaining relationship between CAPEC-174: Flash Parameter Injection and CAPEC-591: Stored XSS. Please refer to these CAPECs going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Phases, Description, Description Summary, Related_Attack_Patterns, Related_Weaknesses

Cross-Site Scripting Using Flash
An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.
Medium
High

The target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concatenated to a constant string defined by the application to form the full command to be executed.

Confidentiality
Integrity
Availability
Execute Unauthorized Commands
A successful command injection attack enables an adversary to alter the command being executed and achieve a variety of negative consequences depending on the makeup of the new command. This includes potential information disclosure or the corruption of application data.

All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary.
Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter.
Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself.

Command Injection

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description, Description Summary, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Related_Weaknesses, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References, Taxonomy_Mappings
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.
Low
High

1
Explore
The adversary initiates an exploratory phase to get familiar with the system.

2
Explore
The adversary triggers a first action (such as holding a resource) and initiates a second action which will wait for the first one to finish.

3
Explore
If the target program has a deadlock condition, the program waits indefinitely resulting in a denial of service.

The target host has a deadlock condition. There are four conditions for a deadlock to occur, known as the Coffman conditions. [REF-101]
The target host exposes an API to the user.

This type of attack may be sophisticated and require knowledge about the system's resources and APIs.

Availability
Resource Consumption
A successful forced deadlock attack compromises the availability of the system by exhausting its available resources.

Use known algorithm to avoid deadlock condition (for instance non-blocking synchronization algorithms).
For competing actions, use well-known libraries which implement synchronization.

An example of a deadlock which may occur in database products is the following. Client applications using the database may require exclusive access to a table, and in order to gain exclusive access they ask for a lock. If one client application holds a lock on a table and attempts to obtain the lock on a second table that is already held by a second client application, this may lead to deadlock if the second application then attempts to obtain the lock that is held by the first application (Source: Wikipedia, http://en.wikipedia.org/wiki/Deadlock)

1499.004
Endpoint Denial of Service: Application or System Exploitation

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns, Type (Relationship -> Attack_Pattern)

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Attack_Motivation-Consequences, Attack_Phases, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Probing_Techniques, Related_Weaknesses, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Prerequisites

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.
Medium

The targeted application must have a bug that allows an adversary to control which code file is loaded at some juncture.
Some variants of this attack may require that old versions of some code files be present and in predictable locations.

The adversary needs to have enough access to the target application to control the identity of a locally included file. The attacker may also need to be able to upload arbitrary code files to the target machine, although any location for these files may be acceptable.

Integrity
Execute Unauthorized Commands
Through local code inclusion, the adversary compromises the integrity of the application.

Confidentiality
Read Data
An attacker may leverage local code inclusion in order to print sensitive data to a page, such as hidden configuration files or or password hashes.

Implementation: Avoid passing user input to filesystem or framework API. If necessary to do so, implement a specific, allowlist approach.

1055
Process Injection

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated References

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Resources_Required, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References
The attacker loads and executes an arbitrary local PHP file on a target machine. The attacker could use this to try to load old versions of PHP files that have known vulnerabilities, to load PHP files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.
Medium

1
Explore
[Survey application] Using a browser or an automated tool, an adversary follows all public links on a web site. They record all the links they find. The adversary is looking for URLs that show PHP file inclusion is used, which can look something like "http://vulnerable-website/file.php?file=index.php".
Use a spidering tool to follow and record all links. Make special note of any links that include parameters in the URL.
Use a proxy tool to record all links visited during a manual traversal of the web application. Make special note of any links that include parameters in the URL. Manual traversal of this type is frequently necessary to identify forms that are GET method forms rather than POST forms.
Use a browser to manually explore the website and analyze how it is constructed. Many browser's plugins are available to facilitate the analysis or automate the URL discovery.

2
Experiment
[Attempt variations on input parameters] Once the adversary finds a vulnerable URL that takes file input, they attempt a variety of path traversal techniques to attempt to get the application to display the contents of a local file, or execute a different PHP file already stored locally on the server.
Use a list of probe strings to inject in parameters of known URLs. The probe strings are variants of path traversal techniques used to include well known files.
Use a proxy tool to record results of manual input of local file inclusion probes in known URLs.

3
Exploit
[Include desired local file] Once the adversary has determined which techniques of path traversal successfully work with the vulnerable PHP application, they will target a specific local file to include. These can be files such as "/etc/passwd", "/etc/shadow", or configuration files for the application that might expose sensitive information.

The targeted PHP application must have a bug that allows an attacker to control which code file is loaded at some juncture.

The attacker needs to have enough access to the target application to control the identity of a locally included PHP file.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Execution_Flow
The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load malicious files that the attacker placed on the remote machine, or to otherwise change the functionality of the targeted application in unexpected ways.

Target application server must allow remote files to be included.The malicious file must be placed on the remote machine previously.

Minimize attacks by input validation and sanitization of any user data that will be used by the target application to locate a remote file to be included.

05
Remote File Inclusion

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Prerequisites, Description Summary, Related_Weaknesses, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns
This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Description, Description Summary

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary

Abuse of Transaction Data Structure
This attack pattern has been deprecated as it is a duplicate of the existing attack pattern "CAPEC-65 : Sniff Application Code". Please refer to this other CAPEC going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Architectural_Paradigms, Attack_Motivation-Consequences, Attack_Phases, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, CIA_Impact, Description, Description Summary, Examples-Instances, Frameworks, Languages, Methods_of_Attack, Platforms, Purposes, Related_Attack_Patterns, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Technical_Context, Typical_Likelihood_of_Exploit, Typical_Severity

Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Dynamic Update
This attack pattern has been deprecated as it is a duplicate of the existing attack pattern "CAPEC-65 : Sniff Application Code". Please refer to this other CAPEC going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Architectural_Paradigms, Attack_Motivation-Consequences, Attack_Phases, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, CIA_Impact, Description, Description Summary, Examples-Instances, Frameworks, Languages, Methods_of_Attack, Platforms, Purposes, Related_Attack_Patterns, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Technical_Context, Typical_Likelihood_of_Exploit, Typical_Severity

Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Patching