ATT&CK technique · T1059.007
Command and Scripting Interpreter: JavaScript
Execution· seen in 14 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-4164 KEV CVEsUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-792 KEV CVEsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Input is echoed into a web page as script, running in other users' browsers with their session.
- CWE-1191 KEV CVEImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1201 KEV CVEBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1211 KEV CVEStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1221 KEV CVEHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-2841 KEV CVEImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2851 KEV CVEImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
Controls that mitigate it (16)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CA · Security Assessment and Authorization
CM · Configuration Management
RA · Risk Assessment
SC · System and Communications Protection
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.