CAPEC-538 — Open-Source Library Manipulation
CAPEC-538: Open-Source Library Manipulation
MITRE CAPEC attack pattern
| Status | Stable |
| Typical severity | High |
| Likelihood of attack | Low |
| Catalogue | CAPEC 3.9 (2023-01-24) |
Description
Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.
Where this sits in the chain
A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.
Weaknesses exploited: CWE-494, CWE-829
ATT&CK techniques: T1195.001
Prerequisites
- Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location.
Skills required
- High: Advanced knowledge about the inclusion and specific usage of an open source code project within system being targeted for infiltration.