CAPEC-23: File Content Injection
An adversary poisons files with a malicious payload (targeting the file systems accessible by the target software), which may be passed through by standard channels such as via email, and standard web content like PDF and multimedia files. The adversary exploits known vulnerabilities or handling routines in the target processes, in order to exploit the host's trust in executing remote content, including binary files.
Examples
PHP is a very popular language used for developing web applications. When PHP is used with global variables, a vulnerability may be opened that affects the file system. A standard HTML form that allows for remote users to upload files, may also place those files in a public directory where the adversary can directly access and execute them through a browser. This vulnerability allows remote adversaries to execute arbitrary code on the system, and can result in the adversary being able to erase intrusion evidence from system and application logs.
Requirements and Mitigations
Requirements
Component properties that must be true for this threat to apply:
Mitigations
Component properties that mitigate this threat:
Affected Components
| Component | Description | Boundary |
|---|---|---|
| DZ App | Primary DZ application and interface, executed on the host machine | Local host |
| Cosign Binary (build machines) | Cosign binary running on the build machine | FPF-operated Tailnet |