CAPEC-35
Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-35: Leverage Executable Code in Non-Executable Files: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/35.html and https://cve.bz/cve/capec/35?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The attacker must have the ability to modify non-executable files consumed by the target software.
Skills required
- Low skill
To identify and execute against an over-privileged system interface
Resources required
Ability to communicate synchronously or asynchronously with server that publishes an over-privileged directory, program, or interface. Optionally, ability to capture output directly through synchronous communication or other method such as FTP.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Execute Unauthorized Commands | Confidentiality, Integrity, Availability | Run Arbitrary Code |
| Modify Data | Integrity | |
| Gain Privileges | Confidentiality, Access Control, Authorization |
Mitigations
Design: Enforce principle of least privilege
Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.
Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.
Implementation: Implement host integrity monitoring to detect any unwanted altering of configuration files.
Implementation: Ensure that files that are not required to execute, such as configuration files, are not over-privileged, i.e. not allowed to execute.
Weaknesses it exploits
- CWE-59 Improper Link Resolution Before File Access
- CWE-94 Improper Control of Generation of Code
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code
- CWE-96 Improper Neutralization of Directives in Statically Saved Code
- CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
- CWE-270 Privilege Context Switching Error
- CWE-272 Least Privilege Violation
- CWE-282 Improper Ownership Management
Recent CVEs with these weaknesses
- 8.6CVE-2026-109097
A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user …
- 8.1CVE-2026-91764
Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00.
- 7.3CVE-2026-86578
Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01.
- 2.0CVE-2026-125082
A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Re…
- 7.2CVE-2026-120009
SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute…
- 9.9CVE-2026-109803
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functio…
- 9.9CVE-2026-109795
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to i…
- 2.3CVE-2026-123373
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. …
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-636 Hiding Malicious Data or Code within Files
Examples
Virtually any system that relies on configuration files for runtime behavior is open to this attack vector. T…
Virtually any system that relies on configuration files for runtime behavior is open to this attack vector. The configuration files are frequently stored in predictable locations, so an attacker that can fingerprint a server process such as a web server or database server can quickly identify the likely locale where the configuration is stored. And this is of course not limited to server processes. Unix shells rely on profile files to store environment variables, search paths for programs and so on. If the aliases are changed, then a standard Unix "cp" command can be rerouted to "rm" or other standard command so the user's intention is subverted.
The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benig…
The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser.
Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the…
Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
The attack can also target server processes. The attacker edits the resource or configuration file, for examp…
The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality.
<security-constraint>
<description>Security processing rules for admin screens</description>
<url-pattern>/admin/*</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
<auth-constraint>
<role-name>administrator</role-name>
<role-name>public</role-name>
</auth-constraint>
</security-constraint>The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
MITRE's words, unchanged: CAPEC-35 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.