Nama: Improper Neutralization of HTTP Headers for Scripting Syntax

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Informasi Umum

Mode Pengenalan

Implementation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Teknologi

Kelas: Web Based (Undetermined)
Nama: Web Server (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Integrity Confidentiality Availability	Execute Unauthorized Code or Commands Catatan: The header may contain a script that will get executed in the client's browser context, potentially resulting in a cross site scripting vulnerability or possibly an HTTP response splitting attack.
Confidentiality	Read Application Data Catatan: Attackers may be able to obtain sensitive information.

Contoh yang Diamati

Referensi	Deskripsi
CVE-2006-3918	Web server does not remove the Expect header from an HTTP request when it is reflected back in an error message, allowing a Flash SWF file to perform XSS attacks.

Mitigasi yang Memungkinkan

Phases : Architecture and Design
Carefully control data that is being placed both in HTTP response headers and in the HTTP response body to ensure that no scripting syntax is present, taking various encodings into account. Perform output validation in order to filter/escape/encode unsafe data that is being passed from the server in an HTTP response header.
Phases : Architecture and Design
Disable script execution functionality in the clients' browser.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
Evgeny Lebanidze	Cigital	2008-01-30 +00:00	2008-01-30 +00:00	Draft 8

Modifikasi

Nama	Organisasi	Tanggal	Komentar
Sean Eidemiller	Cigital	2008-07-01 +00:00	added/updated demonstrative examples
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Observed_Example
CWE Content Team	MITRE	2008-10-14 +00:00	updated Description, Name, Observed_Examples, Relationships
CWE Content Team	MITRE	2009-03-10 +00:00	updated Relationships
CWE Content Team	MITRE	2009-05-27 +00:00	updated Description, Name
CWE Content Team	MITRE	2009-10-29 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2010-04-05 +00:00	updated Description, Name
CWE Content Team	MITRE	2010-06-21 +00:00	updated Demonstrative_Examples, Description, Observed_Examples
CWE Content Team	MITRE	2010-12-13 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2011-03-29 +00:00	updated Description
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Enabling_Factors_for_Exploitation
CWE Content Team	MITRE	2020-02-24 +00:00	updated Applicable_Platforms, Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Potential_Mitigations

Detail CWE-644

CWE-644