CAPEC-267
Leverage Alternate Encoding
An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-267: Leverage Alternate Encoding: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/267.html and https://cve.bz/cve/capec/267?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application.
4 techniques
- Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
- Use a proxy tool to record all user input entry points visited during a manual traversal of the web application.
- Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
- Manually inspect the application to find entry points.
Experiment
They probe what they found.
[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various payloads using a variety of different types of encodings to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited.
1 technique
- Try to use different encodings of content in order to bypass validation routines.
Prerequisites
The application's decoder accepts and interprets encoded characters. Data canonicalization, input filtering and validating is not done properly leaving the door open to harmful characters for the target host.
Skills required
- Low skill
An adversary can inject different representation of a filtered character in a different encoding.
- Medium skill
An adversary may craft subtle encoding of input data by using the knowledge that they have gathered about the target host.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | |
| Read Data | Confidentiality | |
| Execute Unauthorized Commands | Authorization | Run Arbitrary Code |
| Gain Privileges | Accountability, Authentication, Authorization, Non-Repudiation | |
| Bypass Protection Mechanism | Access Control, Authorization | |
| Unreliable Execution, Resource Consumption | Availability | Denial of Service |
Mitigations
Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc.)
Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input.
Weaknesses it exploits
- CWE-20 Improper Input Validation
- CWE-73 External Control of File Name or Path
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
- CWE-172 Improper Encoding or Decoding of Data
- CWE-173 Improper Handling of Alternate Encoding
- CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
- CWE-181 Incorrect Behavior Order: Validate Before Filter
- CWE-692 Incomplete Denylist to Cross-Site Scripting
- CWE-697 Incorrect Comparison
Recent CVEs with these weaknesses
- 9.6CVE-2026-108186
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- 4.9CVE-2026-105427
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.
- 6.7CVE-2026-105426
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.
- 4.3CVE-2026-123178
An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionalit…
- 6.3CVE-2026-125871
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…
- 5.5CVE-2026-125703
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancilla…
- 5.3CVE-2026-125113
The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdX…
- 5.3CVE-2026-125110
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated at…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-153 Input Data Manipulation
- More specific patterns
- CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
- CAPEC-4 Using Alternative IP Address Encodings
- CAPEC-43 Exploiting Multiple Input Interpretation Layers
- CAPEC-52 Embedding NULL Bytes
- CAPEC-53 Postfix, Null Terminate, and Backslash
- CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
- CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
- CAPEC-72 URL Encoding
- CAPEC-78 Using Escaped Slashes in Alternate Encoding
- CAPEC-79 Using Slashes in Alternate Encoding
- CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic
- CAPEC-120 Double Encoding
Examples
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings,…
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote adversaries to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Information Disclosure Vulnerability." Related Vulnerabilities CVE-2010-0488
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encodin…
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
MITRE's words, unchanged: CAPEC-267 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.