Flux d'exécution
1) Explore
[Footprint file input vectors] Manually or using an automated tool, an attacker searches for all input locations where a user has control over the filenames or MIME types of files submitted to the web server.
Technique
- Attacker manually crawls application to identify file inputs
- Attacker uses an automated tool to crawl application identify file inputs
- Attacker manually assesses strength of access control protecting native application files from user control
- Attacker explores potential for submitting files directly to the web server via independently constructed HTTP Requests
2) Experiment
[File misclassification shotgunning] An attacker makes changes to file extensions and MIME types typically processed by web servers and looks for abnormal behavior.
Technique
- Attacker submits files with switched extensions (e.g. .php on a .jsp file) to web server.
- Attacker adds extra characters (e.g. adding an extra . after the file extension) to filenames of files submitted to web server.
3) Experiment
[File misclassification sniping] Understanding how certain file types are processed by web servers, an attacker crafts varying file payloads and modifies their file extension or MIME type to be that of the targeted type to see if the web server is vulnerable to misclassification of that type.
Technique
- Craft a malicious file payload, modify file extension to the targeted file type and submit it to the web server.
- Craft a malicious file payload, modify its associated MIME type to the targeted file type and submit it to the web server.
4) Exploit
[Disclose information] The attacker, by manipulating a file extension or MIME type is able to make the web server return raw information (not executed).
Technique
- Manipulate the file names that are explicitly sent to the server.
- Manipulate the MIME sent in order to confuse the web server.
Conditions préalables
Web server software must rely on file name or file extension for processing.
The attacker must be able to make HTTP requests to the web server.
Compétences requises
To modify file name or file extension
To use misclassification to force the Web server to disclose configuration information, source, or binary data
Ressources nécessaires
None: No specialized resources are required to execute this type of attack.
Atténuations
Implementation: Server routines should be determined by content not determined by filename or file extension.
Faiblesses connexes
CWE-ID |
Nom de la faiblesse |
|
Deployment of Wrong Handler The wrong "handler" is assigned to process an object. |
Références
REF-1
Exploiting Software: How to Break Code
G. Hoglund, G. McGraw.
REF-6
Orion Application Server JSP Source Disclosure Vulnerability (Bugtraq ID: 17204)
http://www.securityfocus.com/bid/17204/info
Soumission
Nom |
Organisation |
Date |
Date de publication |
CAPEC Content Team |
The MITRE Corporation |
2014-06-23 +00:00 |
|
Modifications
Nom |
Organisation |
Date |
Commentaire |
CAPEC Content Team |
The MITRE Corporation |
2017-01-09 +00:00 |
Updated Related_Attack_Patterns |
CAPEC Content Team |
The MITRE Corporation |
2017-08-04 +00:00 |
Updated Attack_Prerequisites, Resources_Required |
CAPEC Content Team |
The MITRE Corporation |
2018-07-31 +00:00 |
Updated Related_Attack_Patterns, Related_Weaknesses |
CAPEC Content Team |
The MITRE Corporation |
2019-04-04 +00:00 |
Updated Related_Weaknesses |
CAPEC Content Team |
The MITRE Corporation |
2020-07-30 +00:00 |
Updated Example_Instances |
CAPEC Content Team |
The MITRE Corporation |
2022-02-22 +00:00 |
Updated Description, Extended_Description |
CAPEC Content Team |
The MITRE Corporation |
2022-09-29 +00:00 |
Updated Example_Instances, Taxonomy_Mappings |