ATT&CK technique · T1195.002
Supply Chain Compromise: Compromise Software Supply Chain
Initial Access· seen in 2 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-13361 KEV CVEImproper Neutralization of Special Elements Used in a Template EngineInput is rendered as a template, so template syntax in it runs on the server.
- CWE-9171 KEV CVEImproper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')Input is evaluated by a template or expression language (as in Log4Shell), executing attacker logic.
- CWE-941 KEV CVEImproper Control of Generation of Code ('Code Injection')Input becomes part of code the application executes, handing attackers the application itself.
- CWE-951 KEV CVEImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Input is passed to an eval-style function and runs as code.
Controls that mitigate it (11)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
CA · Security Assessment and Authorization
CM · Configuration Management
RA · Risk Assessment
SA · System and Services Acquisition
SI · System and Information Integrity
SR · Supply Chain Risk Management
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.