CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Description

Common consequences· 5

• Confidentiality — Read Application Data
  Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
• Access Control — Bypass Protection Mechanism
  In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
• Other — Alter Execution Logic
  Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
• Integrity / Other — Other
  Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
• Non-Repudiation — Hide Activities
  Often the actions performed by injected control code are unlogged.

Potential mitigations· 2

• [Requirements]Programming languages and supporting technologies might be chosen which are not subject to these issues.
• [Implementation]Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Related CAPEC attack patterns· 37

Exploits (incoming)31

Showing top 30 of 31 by confidence. Click any target to see the full neighbourhood.

(incoming)119

Showing top 30 of 119 by confidence. Click any target to see the full neighbourhood.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.