CAPEC-75

Manipulating Writeable Configuration Files

Very High severityHigh likelihoodStandard pattern

Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.

On this page

Ask an AI about this attack pattern
Prerequisites
Skills required
Consequences
Mitigations
Weaknesses it exploits
Related attack patterns
Examples

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-75: Manipulating Writeable Configuration Files: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/75.html and https://cve.bz/cve/capec/75?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

Prerequisites

Configuration files must be modifiable by the attacker

Skills required

Medium skill
To identify vulnerable configuration files, and understand how to manipulate servers and erase forensic evidence

Consequences

What a successful attack can lead to
Impact	Affects	Note
Gain Privileges	Confidentiality, Access Control, Authorization

Mitigations

Design: Enforce principle of least privilege
Design: Backup copies of all configuration files
Implementation: Integrity monitoring for configuration files
Implementation: Enforce audit logging on code and configuration promotion procedures.
Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD

Weaknesses it exploits

CWE-77 Improper Neutralization of Special Elements used in a Command
CWE-99 Improper Control of Resource Identifiers
CWE-346 Origin Validation Error
CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-353 Missing Support for Integrity Check
CWE-354 Improper Validation of Integrity Check Value

Recent CVEs with these weaknesses

8.1CVE-2026-1081872026-11-10
Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
8.8CVE-2026-125732026-11-10
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.
8.0CVE-2026-956462026-11-10
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators …
7.4CVE-2026-1238012026-11-09
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseT…
6.3CVE-2026-1242492026-11-09
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delet…
8.6CVE-2026-1245852026-11-09
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipula…
9.3CVE-2026-1245802026-11-09
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulatio…
6.3CVE-2026-1235832026-11-08
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-176 Configuration/Environment Manipulation

Examples

The BEA Weblogic server uses a config.xml file to store configuration data. If this file is not properly prot…

The BEA Weblogic server uses a config.xml file to store configuration data. If this file is not properly protected by the system access control, an attacker can write configuration information to redirect server output through system logs, database connections, malicious URLs and so on. Access to the Weblogic server may be from a so-called Custom realm which manages authentication and authorization privileges on behalf of user principals. Given write access, the attacker can insert a pointer to a custom realm jar file in the config.xml

<CustomRealm
  ConfigurationData="java.util.Properties"
  Name="CustomRealm"
  RealmClassName="Maliciousrealm.jar"
  />

The main issue with configuration files is that the attacker can leverage all the same functionality the server has, but for malicious means. Given the complexity of server configuration, these changes may be very hard for administrators to detect.

MITRE's words, unchanged: CAPEC-75 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.