CAPEC Definitions / CAPEC-75
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
Extended Description
No Extended Description.
Mitigations
Design: Enforce principle of least privilege
Design: Backup copies of all configuration files
Implementation: Integrity monitoring for configuration files
Implementation: Enforce audit logging on code and configuration promotion procedures.
Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD
Relationships with other CAPECs
CAPEC-176: Configuration/Environment Manipulation
Prerequisites
Configuration files must be modifiable by the attacker
Related Weaknesses
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-346: Origin Validation Error
CWE-353: Missing Support for Integrity Check
CWE-354: Improper Validation of Integrity Check Value
