T1190 Exploit Public-Facing Application
High-Level Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Defense Evasion or Exploitation for Client Execution.
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.
Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.
Kill Chain Phase
Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
What to Check
How to Test
Manual Testing
-
Identify Attack Surface: Determine if the target environment is susceptible to Exploit Public-Facing Application by examining the target platforms (Containers, ESXi, IaaS).
-
Assess Existing Defenses: Review whether mitigations for T1190 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
-
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
M1048 Application Isolation and Sandboxing
Application isolation will limit what other processes and system features the exploited target can access.
M1037 Filter Network Traffic
Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.
M1030 Network Segmentation
Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
M1016 Vulnerability Scanning
Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.
M1026 Privileged Account Management
Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
M1050 Exploit Protection
Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.
M1035 Limit Access to Resource Over Network
Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.
M1051 Update Software
Update software regularly by employing patch management for externally exposed applications.
Detection
Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
Risk Assessment
| Finding | Severity | Impact |
|---|
| Exploit Public-Facing Application technique applicable | High | Initial Access |
CWE Categories
| CWE ID | Title |
|---|
| CWE-20 | Improper Input Validation |
References
