CWE-20: Improper Input Validation

Step-by-step: how CWE-20 gets exploited

A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.

1. 1
   Executionexecution

   Run attacker-chosen code or commands on the system.

   At risk / what's stolen

   Application logic and the host runtime — an attacker can execute arbitrary code or commands.

   How you defend

   Least-privilege runtime, sandboxing, and safe deserialization/parsing.

2. 2
   Privilege escalationprivilege-escalation

   Gain higher privileges — from a limited account to admin/root.

   At risk / what's stolen

   Over-permissioned services, weak file/permission boundaries, and setuid paths.

   How you defend

   Drop privileges, enforce least privilege, and lock down file permissions.

3. 3
   Credential accesscredential-access

   Steal passwords, tokens, keys, and session material.

   At risk / what's stolen

   Passwords, API keys, session tokens, SSH/TLS keys, and secrets in memory, env, or config.

   How you defend

   Secret managers, short-lived tokens, and no secrets in code/env/logs.

4. 4
   Discoverydiscovery

   Map what else is reachable — hosts, services, data stores, and accounts.

   At risk / what's stolen

   Internal topology, service inventory, and data locations the attacker enumerates.

   How you defend

   Network segmentation and detection of unusual internal scanning.

5. 5
   Impactimpact

   Cause damage — destroy, encrypt, deny, or manipulate.

   At risk / what's stolen

   Availability and integrity: ransomware encryption, data wiping, or service denial.

   How you defend

   Tested offline backups, integrity checks, and rate/abuse limiting.

This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.