CWE-646 Detail

CWE-646

Reliance on File Name or Extension of Externally-Supplied File
Hoog
Incomplete
2008-01-30
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Meldingen voor een CWE
Blijf op de hoogte van wijzigingen voor een specifieke CWE.
Meldingen beheren

Naam: Reliance on File Name or Extension of Externally-Supplied File

The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

CWE-beschrijving

An application might use the file name or extension of a user-supplied file to determine the proper course of action, such as selecting the correct process to which control should be passed, deciding what data should be made available, or what resources should be allocated. If the attacker can cause the code to misclassify the supplied file, then the wrong action could occur. For example, an attacker could supply a file that ends in a ".php.gif" extension that appears to be a GIF image, but would be processed as PHP code. In extreme cases, code execution is possible, but the attacker could also cause exhaustion of resources, denial of service, exposure of debug or system data (including application source code), or being bound to a particular server side process. This weakness may be due to a vulnerability in any of the technologies used by the web and application servers, due to misconfiguration, or resultant from another flaw in the application itself.

Algemene informatie

Introductiemodi

Architecture and Design
Implementation
Operation

Toepasselijke platforms

Taal

Class: Not Language-Specific (Undetermined)

Technologieën

Name: Web Server (Undetermined)

Veelvoorkomende gevolgen

Bereik Impact Waarschijnlijkheid
ConfidentialityRead Application Data

Note: An attacker may be able to read sensitive data.
AvailabilityDoS: Crash, Exit, or Restart

Note: An attacker may be able to cause a denial of service.
Access ControlGain Privileges or Assume Identity

Note: An attacker may be able to gain privileges.

Mogelijke risicobeperkingen

Phases : Architecture and Design
Make decisions on the server side based on file content and not on file name or extension.

Notities kwetsbaarheidsmapping

Rechtvaardiging : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Opmerking : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Gerelateerde aanvalspatronen

CAPEC-ID Naam aanvalspatroon
CAPEC-209 XSS Using MIME Type Mismatch
An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's script may run on the target unsanitized, possibly revealing the victim's cookies or executing arbitrary script in their browser.

Indiening

Naam Organisatie Datum Releasedatum Version
Evgeny Lebanidze Cigital 2008-01-30 +00:00 2008-01-30 +00:00 Draft 8

Wijzigingen

Naam Organisatie Datum Opmerking
CWE Content Team MITRE 2008-09-08 +00:00 updated Common_Consequences, Relationships, Observed_Example
CWE Content Team MITRE 2008-10-13 +00:00 Significant clarification of the weakness description.
CWE Content Team MITRE 2008-10-14 +00:00 updated Description, Name, Observed_Examples, Relationships
CWE Content Team MITRE 2009-07-27 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2009-10-29 +00:00 updated Common_Consequences
CWE Content Team MITRE 2010-12-13 +00:00 updated Applicable_Platforms, Common_Consequences
CWE Content Team MITRE 2011-03-29 +00:00 updated Common_Consequences, Description
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Enabling_Factors_for_Exploitation
CWE Content Team MITRE 2020-02-24 +00:00 updated Applicable_Platforms, Relationships
CWE Content Team MITRE 2021-10-28 +00:00 updated Relationships
CWE Content Team MITRE 2023-01-31 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Description, Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Relationships, Weakness_Ordinalities
De informatie die op CVE Find wordt gepresenteerd, is afkomstig van verschillende zorgvuldig geselecteerde referentiebronnen. CVE-gegevens worden geleverd door MITRE Corporation en de National Vulnerability Database (NVD). De Known Exploited Vulnerabilities (KEV)-catalogus is afkomstig van de Cybersecurity and Infrastructure Security Agency (CISA), terwijl EPSS-scores afkomstig zijn van FIRST.org. Daarnaast worden gegevens over softwarezwakheden (CWE) en veelvoorkomende aanvalspatronen (CAPEC) bijgehouden door MITRE Corporation, en informatie over hardware- en softwareconfiguraties (CPE) wordt geleverd door de NVD.