CAPEC-6
Argument Injection
An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-6: Argument Injection: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/6.html and https://cve.bz/cve/capec/6?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Discovery of potential injection vectors] Using an automated tool or manual discovery, the attacker identifies services or methods with arguments that could potentially be used as injection vectors (OS, API, SQL procedures, etc.).
2 techniques
- Manually cover the application and record the possible places where arguments could be passed into external systems.
- Use a spider, for web applications, to create a list of URLs and associated inputs.
Experiment
They probe what they found.
[1. Attempt variations on argument content] Possibly using an automated tool, the attacker will perform injection variations of the arguments.
2 techniques
- Use a very large list of probe strings in order to detect if there is a positive result, and, what type of system has been targeted (if obscure).
- Use a proxy tool to record results, error messages and/or log if accessible.
Exploit
They carry out the attack.
[Abuse of the application] The attacker injects specific syntax into a particular argument in order to generate a specific malicious effect in the targeted application.
1 technique
- Manually inject specific payload into targeted argument.
Prerequisites
Target software fails to strip all user-supplied input of any content that could cause the shell to perform unexpected actions.
Software must allow for unvalidated or unfiltered input to be executed on operating system shell, and, optionally, the system configuration must allow for output to be sent back to client.
Skills required
- Medium skill
The attacker has to identify injection vector, identify the operating system-specific commands, and optionally collect the output.
Resources required
Ability to communicate synchronously or asynchronously with server. Optionally, ability to capture output directly through synchronous communication or other method such as FTP.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Confidentiality, Access Control, Authorization | |
| Modify Data | Integrity | |
| Read Data | Confidentiality |
Mitigations
Design: Do not program input values directly on command shell, instead treat user input as guilty until proven innocent. Build a function that takes user input and converts it to applications specific types and values, stripping or filtering out all unauthorized commands and characters in the process.
Design: Limit program privileges, so if metacharacters or other methods circumvent program input validation routines and shell access is attained then it is not running under a privileged account. chroot jails create a sandbox for the application to execute in, making it more difficult for an attacker to elevate privilege even in the case that a compromise has occurred.
Implementation: Implement an audit log that is written to a separate host, in the event of a compromise the audit log may be able to provide evidence and details of the compromise.
Weaknesses it exploits
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
- CWE-146 Improper Neutralization of Expression/Command Delimiters
- CWE-184 Incomplete List of Disallowed Inputs
- CWE-185 Incorrect Regular Expression
- CWE-697 Incorrect Comparison
Recent CVEs with these weaknesses
- 7.2CVE-2026-105425
OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code…
- 8.8CVE-2026-123717
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the op…
- 7.0CVE-2026-109830
A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration f…
- 8.6CVE-2026-60039
A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60038
A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60037
A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60036
A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60035
A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-137 Parameter Injection
Examples
A recent example instance of argument injection occurred against Java Web Start technology, which eases the c…
A recent example instance of argument injection occurred against Java Web Start technology, which eases the client side deployment for Java programs. The JNLP files that are used to describe the properties for the program. The client side Java runtime used the arguments in the property setting to define execution parameters, but if the attacker appends commands to an otherwise legitimate property file, then these commands are sent to the client command shell. [REF-482]
MITRE's words, unchanged: CAPEC-6 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.