ATT&CK technique · T1505
Server Software Component
Persistence· seen in 2 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-2841 KEV CVEImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2851 KEV CVEImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-6391 KEV CVEAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
- CWE-771 KEV CVEImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-781 KEV CVEImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-8621 KEV CVEMissing AuthorizationNo permission check is made before the action, so any logged-in user can perform it.
- CWE-8631 KEV CVEIncorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
Controls that mitigate it (21)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CM · Configuration Management
IA · Identification and Authentication
RA · Risk Assessment
SA · System and Services Acquisition
SC · System and Communications Protection
SI · System and Information Integrity
SR · Supply Chain Risk Management
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.