Desktop protocol handler misinterprets external input
An OS-dispatched URL reaches a native command or operation with attacker-controlled arguments outside the intended handler contract.
Candidate CWE: CWE-88
Test hypothesis#
Invoke a harmless discovered scheme normally, then vary one encoded argument in a local fixture and observe parsing and the eventual operation.
Evidence required#
Packaged application/OS, registered scheme, exact URI, argument construction, required interaction and protected effect.
Rule out false positives#
Protocol registration and opening a legitimate application are expected. Do not label parsing errors as command execution without a verified command boundary.
Playbook and command references#
- Desktop IPC, Electron bridges and native protocols — Follow page, file and local-process inputs into privileged desktop capabilities with a realistic caller.
- Uploads, downloads, paths, archives, and XML — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
- T1203 · Exploitation for Client Execution — Only if: A client-application vulnerability executes attacker-controlled code when the client processes a file, document, or other content; identify the affected desktop/client process. Not established by: A parser crash alone is insufficient. Ordinary web XSS is not automatically a native client execution exploit, and Mobile uses separate technique IDs.