| Home > CAPEC List > CAPEC-183: IMAP/SMTP Command Injection (Version 3.9) |
|
Medium
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Meta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises. | 248 | Command Injection |
| View Name | Top Level Categories |
|---|---|
| Domains of Attack | Software |
| Mechanisms of Attack | Inject Unexpected Items |
Identify Target Web-Mail Server: The adversary first identifies the web-mail server they wish to exploit.
Identify Vulnerable Parameters: Once the adversary has identified a web-mail server, they identify any vulnerable parameters by altering their values in requests. The adversary knows that the parameter is vulnerable if the web-mail server returns an error of any sort. Ideally, the adversary is looking for a descriptive error message.
| Techniques |
|---|
| Assign a null value to a parameter being used by the web-mail server and observe the response. |
| Assign a random value to a parameter being used by the web-mail server and observe the response. |
| Add additional values to a parameter being used by the web-mail server and observe the response. |
| Add non standard special characters (i.e.: ,円 ', ", @, #, !, |) to a parameter being used by the web-mail server and observe the response. |
| Eliminate a parameter being used by the web-mail server and observe the response. |
Determine Level of Injection: After identifying all vulnerable parameters, the adversary determines what level of injection is possible.
| Techniques |
|---|
| Evaluate error messages to determine what IMAP/SMTP command is being executed for the vulnerable parameter. Sometimes the actually query will be placed in the error message. |
| If there aren't descriptive error messages, the adversary will analyze the affected functionality to deduce the possible commands that could be being used by the mail-server. |
Inject IMAP/SMTP Commands: The adversary manipulates the vulnerable parameters to inject an IMAP/SMTP command and execute it on the mail-server.
| Techniques |
|---|
| Structure the injection as a header, body, and footer. The header contains the ending of the expected message, the body contains the injection of the new command, and the footer contains the beginning of the expected command. |
| Each part of the injection payload needs to be terminated with the CRLF (%0d%0a) sequence. |
| CWE-ID | Weakness Name |
|---|---|
| 77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| Submissions | ||
|---|---|---|
| Submission Date | Submitter | Organization |
| 2014年06月23日 (Version 2.6) | CAPEC Content Team | The MITRE Corporation |
| Modifications | ||
| Modification Date | Modifier | Organization |
| 2017年08月04日 (Version 2.11) | CAPEC Content Team | The MITRE Corporation |
| Updated Resources_Required | ||
| 2019年04月04日 (Version 3.1) | CAPEC Content Team | The MITRE Corporation |
| Updated Related_Weaknesses | ||
| 2020年12月17日 (Version 3.4) | CAPEC Content Team | The MITRE Corporation |
| Updated References | ||
| 2022年02月22日 (Version 3.7) | CAPEC Content Team | The MITRE Corporation |
| Updated Description, Execution_Flow | ||
|
Use of the Common Attack Pattern Enumeration and Classification (CAPEC), and the associated references from this website are subject to the Terms of Use. Copyright © 2007–2025, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. |
||