Difference between revisions of "Setting Manipulation"

Jump to: navigation, search
(Related Vulnerabilities)
Line 61: Line 61:
==Related Vulnerabilities==
==Related Vulnerabilities==
* [[:Category:Input General Logic Error Vulnerability]]
* [[:Category:General_Logic_Error_Vulnerability]]
==Related Countermeasures==
==Related Countermeasures==

Revision as of 13:47, 5 November 2007

This is an Attack. To view all attacks, please see the Attack Category page.


This attack aims to modify application settings in order to cause data misleading or advantages on user behalf. He may manipulate values in the system and manages specific resources user by application or affects its functionalities.

An attacker can exploit several functionalities of the application using this attack technique, but it would not possible to describe all the ways of exploration, due to innumerable options that attacker may use to control the system values.

Using this attack technique, it is possible to manipulate settings by changing the application functions, such as calls to the database, blocking access to external libraries and/or modification log files.



Likelihood of exploitation

Medium to Low


Example 1

An attacker needs to identify the variables without input validation or improperly encapsulated to obtain success in the attack.

The following example was based on the ones found in the Individual CWE Dictionary Definition (Setting Manipulation-15).

Consider the following piece of Java code:


This fragment reads the string “catalog” from “HttpServletRequest” and sets it as the active catalog for a database connection. An attacker could manipulate this information and cause connection error or unauthorized access to other catalogs.

Example 2 – Block Access to Libraries

The attacker has the privileges to block application access to external libraries to execute this attack. It is necessary discover what external libraries are accessed by application and block it. The attacker needs to observe if behavior of the system goes into an insecure/inconsistent state.

In this case the application uses a third party cryptographic random number generation library that used in generation of user session ids. An attacker may block to access this library by renaming it. Then an application will be use the weak pseudo random number generation library. The attacker can use this weakness to predict the session id user, he/she attempts to perform elevation of privilege escalation and gains access user’s account.

For more details about this attack, see: http://capec.mitre.org/data/definitions/96.html

External References

http://cwe.mitre.org/data/definitions/15.html - Setting Manipulation

http://capec.mitre.org/data/definitions/13.html - Subverting Environment Variable Values

http://capec.mitre.org/data/definitions/96.html - Block Access to Libraries

Related Threats

Category: Logical Attacks

Related Attacks

Related Vulnerabilities

Related Countermeasures