Detailedlikelihood: Highseverity: HighDraft
CAPEC-78Using Escaped Slashes in Alternate Encoding
Abstraction
Detailed
Status
Draft
Likelihood
High
Severity
High
Description
This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.
Related weaknesses· 10
Related attack patterns· 1
Exploits10
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Neutralizationcwe-707 | 100% | live |
| Weakness | External Control of File Name or Pathcwe-73 | 100% | live |
| Weakness | Incorrect Comparisoncwe-697 | 100% | live |
| Weakness | Improper Handling of Alternate Encodingcwe-173 | 100% | live |
| Weakness | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')cwe-22 | 100% | live |
| Weakness | Incorrect Behavior Order: Validate Before Canonicalizecwe-180 | 100% | live |
| Weakness | Improper Input Validationcwe-20 | 100% | live |
| Weakness | Incorrect Behavior Order: Validate Before Filtercwe-181 | 100% | live |
| Weakness | Encoding Errorcwe-172 | 100% | live |
| Weakness | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')cwe-74 | 100% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.