CAPEC-17

Using Malicious Files

Very High severityHigh likelihoodStandard pattern

An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.

On this page

Ask an AI about this attack pattern
How the attack unfolds
Prerequisites
Skills required
Resources required
Consequences
Mitigations
Weaknesses it exploits
Related attack patterns
Examples

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-17: Using Malicious Files: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/17.html and https://cve.bz/cve/capec/17?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

Explore
The attacker looks for a way in.
1. [Determine File/Directory Configuration] The adversary looks for misconfigured files or directories on a system that might give executable access to an overly broad group of users.
  1 technique
  - Through shell access to a system, use the command "ls -l" to view permissions for files and directories.
Experiment
They probe what they found.
1. [Upload Malicious Files] If the adversary discovers a directory that has executable permissions, they will attempt to upload a malicious file to execute.
  1 technique
  - Upload a malicious file through a misconfigured FTP server.
Exploit
They carry out the attack.
1. [Execute Malicious File] The adversary either executes the uploaded malicious file, or executes an existing file that has been misconfigured to allow executable access to the adversary.

Prerequisites

System's configuration must allow an attacker to directly access executable files or upload files to execute. This means that any access control system that is supposed to mediate communications between the subject and the object is set incorrectly or assumes a benign environment.

Skills required

Low skill
To identify and execute against an over-privileged system interface

Resources required

Ability to communicate synchronously or asynchronously with server that publishes an over-privileged directory, program, or interface. Optionally, ability to capture output directly through synchronous communication or other method such as FTP.

Consequences

What a successful attack can lead to
Impact	Affects	Note
Execute Unauthorized Commands	Confidentiality, Integrity, Availability	Run Arbitrary Code
Modify Data	Integrity
Read Data	Confidentiality
Gain Privileges	Confidentiality, Access Control, Authorization

Mitigations

Design: Enforce principle of least privilege
Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.
Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.

Weaknesses it exploits

CWE-59 Improper Link Resolution Before File Access
CWE-270 Privilege Context Switching Error
CWE-272 Least Privilege Violation
CWE-282 Improper Ownership Management
CWE-285 Improper Authorization
CWE-693 Protection Mechanism Failure
CWE-732 Incorrect Permission Assignment for Critical Resource

Recent CVEs with these weaknesses

3.9CVE-2026-145432026-11-10
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-pr…
7.4CVE-2026-129632026-11-10
A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.
8.1CVE-2026-917642026-11-10
Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00.
7.3CVE-2026-865782026-11-10
Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01.
7.3CVE-2026-1121252026-11-10
Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.
7.8CVE-2026-1140312026-11-09
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. Th…
2.3CVE-2026-1233732026-11-09
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. …
2.3CVE-2026-1233712026-11-09
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project a…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-122 Privilege Abuse
Can lead to: CAPEC-233 Privilege Escalation
More specific patterns: CAPEC-177 Create files with the same name as files protected with a higher classification
CAPEC-263 Force Use of Corrupted Files
CAPEC-562 Modify Shared File
CAPEC-563 Add Malicious File to Shared Webroot
CAPEC-642 Replace Binaries
CAPEC-650 Upload a Web Shell to a Web Server

Examples

Consider a directory on a web server with the following permissions

drwxrwxrwx 5 admin public 170 Nov 17 01:08 webroot

This could allow an attacker to both execute and upload and execute programs' on the web server. This one vulnerability can be exploited by a threat to probe the system and identify additional vulnerabilities to exploit.

MITRE's words, unchanged: CAPEC-17 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.