CAPEC-40: Manipulating Writeable Terminal Devices
ID
CAPEC-40
Typical Severity
Very High
Likelihood Of Attack
High
Status
Draft
This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.
Weaknesses
# ID | Name | Type |
---|---|---|
CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | weakness |