CWE-646
Reliance on File Name or Extension of Externally-Supplied File
2008-01-30
00h00 +00:00
00h00 +00:00
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
이름: Reliance on File Name or Extension of Externally-Supplied File
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors.
CWE 설명
This could be used by attackers to cause the file to be
misclassified and processed in a dangerous fashion, causing
the wrong action to occur.
일반 정보
취약점 도입 방식
Array : An application might use the file name or extension of a user-supplied file to determine the proper course of action, such as selecting the correct process to which control should be passed, deciding what data should be made available, or what resources should be allocated.적용 가능한 플랫폼
언어
클래스: Not Language-Specific (Undetermined)기술
이름: Web Server (Undetermined)일반적인 결과
| 범위 | 영향 | 가능성 |
|---|---|---|
| Integrity | Execute Unauthorized Code or Commands 참고: If an attacker can provide a file that is treated as executable, then code execution might be possible. For example, in a web application, an attacker could supply a file that ends in a ".php.gif" extension that appears to be a GIF image, but would be processed as PHP code by the server. | |
| Confidentiality | Read Application Data 참고: An attacker may be able to read sensitive data, e.g., exposure of debug or system data (including application source code) | |
| Availability | DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other) 참고: An attacker may be able to cause a denial of service. | |
| Access Control | Gain Privileges or Assume Identity 참고: An attacker may be able to gain privileges. |
잠재적 완화 방법
Phases : Architecture and DesignMake decisions on the server side based on file content and not on file name or extension.
취약점 매핑 메모
근거 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
관련 공격 패턴
| CAPEC ID | 공격 패턴 이름 |
|---|---|
| CAPEC-209 | XSS Using MIME Type Mismatch
An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's script may run on the target unsanitized, possibly revealing the victim's cookies or executing arbitrary script in their browser. |
제출
| 이름 | 조직 | 날짜 | 출시일 | Version |
|---|---|---|---|---|
| Evgeny Lebanidze | Cigital | Draft 8 |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Observed_Example | |
| CWE Content Team | MITRE | Significant clarification of the weakness description. | |
| CWE Content Team | MITRE | updated Description, Name, Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences, Description | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Enabling_Factors_for_Exploitation | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description, Mapping_Notes | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction, Type, Weakness_Ordinalities |
