CAPEC-53

Postfix, Null Terminate, and Backslash

High severityHigh likelihoodDetailed pattern

If a string is passed through a filter of some kind, then a terminal NULL may not be valid. Using alternate representation of NULL allows an adversary to embed the NULL mid-string while postfixing the proper data so that the filter is avoided. One example is a filter that looks for a trailing slash character. If a string insertion is possible, but the slash must exist, an alternate encoding of NULL in mid-string may be used.

On this page

Ask an AI about this attack pattern
How the attack unfolds
Prerequisites
Skills required
Signs of an attack
Consequences
Mitigations
Weaknesses it exploits
Related attack patterns
Examples

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-53: Postfix, Null Terminate, and Backslash: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/53.html and https://cve.bz/cve/capec/53?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

Explore
The attacker looks for a way in.
1. [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application.
  4 techniques
  - Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
  - Use a proxy tool to record all user input entry points visited during a manual traversal of the web application.
  - Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
  - Manually inspect the application to find entry points.
Experiment
They probe what they found.
1. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects postfix null byte(s) followed by a backslash to observe how the application handles them as input. The adversary is looking for areas where user input is placed in the middle of a string, and the null byte causes the application to stop processing the string at the end of the user input.
  1 technique
  - Try different encodings for null such as \0 or %00 followed by an encoding for the backslash character.
Exploit
They carry out the attack.
1. [Remove data after null byte(s)] After determined entry points that are vulnerable, the adversary places a null byte(s) followed by a backslash such that they bypass an input filter and remove data after the null byte(s) in a way that is beneficial to them.
  1 technique
  - If the input is a directory as part of a longer file path, add a null byte(s) followed by a backslash at the end of the input to try to traverse to the given directory.

Prerequisites

Null terminators are not properly handled by the filter.

Skills required

Medium skill
An adversary needs to understand alternate encodings, what the filter looks for and the data format acceptable to the target API

Signs of an attack

Null characters are observed by the filter. The filter needs to be able to understand various encodings of the Null character, or only canonical data should be passed to it.

Consequences

What a successful attack can lead to
Impact	Affects	Note
Modify Data	Integrity
Read Data	Confidentiality
Gain Privileges	Confidentiality, Access Control, Authorization

Mitigations

Properly handle Null characters. Make sure canonicalization is properly applied. Do not pass Null characters to the underlying APIs.
Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system.

Weaknesses it exploits

CWE-20 Improper Input Validation
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-158 Improper Neutralization of Null Byte or NUL Character
CWE-172 Improper Encoding or Decoding of Data
CWE-173 Improper Handling of Alternate Encoding
CWE-697 Incorrect Comparison
CWE-707 Improper Neutralization

Recent CVEs with these weaknesses

9.6CVE-2026-1081862026-11-10
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
4.9CVE-2026-1054272026-11-10
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.
6.7CVE-2026-1054262026-11-10
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.
4.3CVE-2026-1231782026-11-10
An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionalit…
6.3CVE-2026-1258712026-11-10
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…
5.5CVE-2026-1257032026-11-10
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancilla…
5.3CVE-2026-1251132026-11-09
The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdX…
6.3CVE-2026-618122026-11-09
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on th…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-267 Leverage Alternate Encoding

Examples

A rather simple injection is possible in a URL:

http://getAccessHostname/sekbin/
helpwin.gas.bat?mode=&draw=x&file=x&module=&locale=[insert relative path here]
[%00][%5C]&chapter=

This attack has appeared with regularity in the wild. There are many variations of this kind of attack. Spending a short amount of time injecting against Web applications will usually result in a new exploit being discovered.

MITRE's words, unchanged: CAPEC-53 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.