King of Tampering I
An attacker can load code inside your process via an extension point:
|
Threat |
|
|
|
Your application allows extensions to be uploaded at runtime – for example, a binary or script or even some XML that instructs the machine at runtime. That extension causes the application to behave in an undesired way or even lead to a data disclosure. |
|
CAPEC |
CAPEC-698: Install Malicious Extension. |
|
ASVS |
10.3.2: Ensure the application doesn’t load code from untrusted sources. |
|
CWE |
CWE-434: Unrestricted Upload of File with Dangerous Type CWE-494: Download of Code Without Integrity Check |
|
Mitigations |
|
|
| |
