CAPEC-159
Redirect Access to Libraries
An adversary exploits a weakness in the way an application searches for external libraries to manipulate the execution flow to point to an adversary supplied library or code base. This pattern of attack allows the adversary to compromise the application or server via the execution of unauthorized code. An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. If an adversary can redirect an application's attempts to access these libraries to other libraries that the adversary supplies, the adversary will be able to force the targeted application to execute arbitrary code. This is especially dangerous if the targeted application has enhanced privileges. Access can be redirected through a number of techniques, including the use of symbolic links, search path modification, and relative path manipulation.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-159: Redirect Access to Libraries: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/159.html and https://cve.bz/cve/capec/159?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Identify Target] The adversary identifies the target application and determines what libraries are being used.
2 techniques
- Find public source code and identify library dependencies.
- Gain access to the system hosting the application and look for libraries in common locations.
Experiment
They probe what they found.
[Deploy Malicious Libraries] The adversary crafts malicious libraries and deploys them on the system where the application is running, or in a remote location that can be loaded by the application.
Exploit
They carry out the attack.
[Redirect Library Calls to Malicious Library] Once the malicious library crafted by the adversary is deployed, the adversary will manipulate the flow of the application such that it calls the malicious library. This can be done in a variety of ways based on how the application is loading and calling libraries.
3 techniques
- Poison the DNS cache of the system so that it loads a malicious library from a remote location hosted by the adversary instead of the legitimate location
- Create a symlink that tricks the application into thinking that a malicious library is the legitimate library.
- Use DLL side-loading to place a malicious verison of a DLL in the windows directory.
Prerequisites
The target must utilize external libraries and must fail to verify the integrity of these libraries before using them.
Skills required
- Low skill
To modify the entries in the configuration file pointing to malicious libraries
- Medium skill
To force symlink and timing issues for redirecting access to libraries
- High skill
To reverse engineering the libraries and inject malicious code into the libraries
Consequences
| Impact | Affects | Note |
|---|---|---|
| Execute Unauthorized Commands | Authorization | Run Arbitrary Code |
| Bypass Protection Mechanism | Access Control, Authorization |
Mitigations
Implementation: Restrict the permission to modify the entries in the configuration file.
Implementation: Check the integrity of the dynamically linked libraries before use them.
Implementation: Use obfuscation and other techniques to prevent reverse engineering the libraries.
Weaknesses it exploits
- CWE-706 Use of Incorrectly-Resolved Name or Reference
Recent CVEs with these weaknesses
- 6.5CVE-2026-18484
IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.
- 9.6CVE-2026-121200
Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit…
- 8.1CVE-2026-121133
Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chrom…
- 5.2CVE-2026-119675
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace fi…
- 8.8CVE-2026-118938
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to …
- 8.8CVE-2026-119270
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity:…
- 8.8CVE-2026-119266
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium…
- 8.8CVE-2026-119265
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium securit…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
In this example, the attacker using ELF infection that redirects the Procedure Linkage Table (PLT) of an exec…
In this example, the attacker using ELF infection that redirects the Procedure Linkage Table (PLT) of an executable allowing redirection to be resident outside of the infected executable. The algorithm at the entry point code is as follows... • mark the text segment writeable • save the PLT(GOT) entry • replace the PLT(GOT) entry with the address of the new lib call The algorithm in the new library call is as follows... • do the payload of the new lib call • restore the original PLT(GOT) entry • call the lib call • save the PLT(GOT) entry again (if its changed) • replace the PLT(GOT) entry with the address of the new lib call
MITRE's words, unchanged: CAPEC-159 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.