Threat Event
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
|
|
| ID | CAPEC-242 |
| Latest Sync Date | 11/05/25 15:15:38 |
| Original ID | 242 |
| Abstraction | Meta |
| Status | Stable |
| Alternate Terms | |
| Likelihood Of Attack | High |
| Typical Severity | High |
| Related Attack Patterns | |
| Execution Flow | |
| Prerequisites | ::The target software does not validate user-controlled input such that the execution of a process may be altered by sending code in through legitimate data channels, using no other mechanism.:: |
| Skills Required | |
| Resources Required | |
| Indicators | |
| Consequences | ::SCOPE:Confidentiality:SCOPE:Integrity:SCOPE:Availability:TECHNICAL IMPACT:Other:NOTE:Code Injection attack patterns can result in a wide variety of consequences and negatively affect all three elements of the security triad.:: |
| Mitigations | ::Utilize strict type, character, and encoding enforcement::Ensure all input content that is delivered to client is sanitized against an acceptable content specification.::Perform input validation for all content.::Enforce regular patching of software.:: |
| Example Instances | |
| Related Weaknesses | ::94:: |
| Taxonomy Mappings | TAXONOMY NAME:OWASP Attacks:ENTRY NAME:Code Injection:: |
| Notes | |