ATT&CK technique · T1221
Template Injection
Stealth· seen in 3 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-13212 KEV CVEsImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
- CWE-742 KEV CVEsImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The general injection flaw: data crosses into a component that interprets part of it as instructions.
Controls that mitigate it (14)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
CA · Security Assessment and Authorization
CM · Configuration Management
RA · Risk Assessment
SC · System and Communications Protection
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.