| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | S | 134 | Email Injection |
| ChildOf | M | 242 | Code Injection |
Identify and characterize metacharacter-processing vulnerabilities in email headers
An attacker creates emails with headers containing various metacharacter-based malicious payloads in order to determine whether the target application processes the malicious content and in what manner it does so.
| Technique |
|---|
| Use an automated tool (fuzzer) to create malicious emails headers containing metacharacter-based payloads. |
| Manually tampering email headers to inject malicious metacharacter-based payload content in them. |
An attacker leverages vulnerabilities identified during the Experiment Phase to inject malicious email headers and cause the targeted email application to exhibit behavior outside of its expected constraints.
An attacker leverages vulnerabilities identified during the Experiment Phase to inject malicious email headers and cause the targeted email application to exhibit behavior outside of its expected constraints.
| Technique |
|---|
| Send emails with specifically-constructed, metacharacter-based malicious payloads in the email headers to targeted systems running email processing applications identified as vulnerable during the Experiment Phase. |
To distribute email
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrityAvailability | N/A | Execute Unauthorized Commands | Run Arbitrary Code |
| Taxonomy Name | Entry ID | Entry Name |
|---|