CAPEC-121: Exploit Non-Production Interfaces

MITRE CAPEC attack pattern

Description

An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-489, CWE-1209, CWE-1259, CWE-1267, CWE-1270, CWE-1294, CWE-1295, CWE-1296, CWE-1302, CWE-1313

Prerequisites

• The target must have configured non-production interfaces and failed to secure or remove them when brought into a production environment.

Skills required

• High: Exploiting non-production interfaces requires significant skill and knowledge about the potential non-production interfaces left enabled in production.

Consequences

• Confidentiality, Access Control, Authentication: Gain Privileges, Bypass Protection Mechanism
• Confidentiality, Access Control, Authorization: Read Data, Execute Unauthorized Commands
• Access Control, Integrity: Modify Data, Alter Execution Logic

Mitigations

• Ensure that production systems do not contain non-production interfaces and that these interfaces are only used in development environments.

Source

• MITRE CAPEC CAPEC-121