CWE-433
Unparsed Raw Web Content Delivery
2006-07-19
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Unparsed Raw Web Content Delivery
The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
Mô tả CWE
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.
Thông tin chung
Các cách xuất hiện
ImplementationOperation
Nền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Công nghệ
Lớp: Web Based (Often)Tên: Web Server (Undetermined)
Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Confidentiality | Read Application Data |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2002-1886 | ".inc" file stored under web document root and returned unparsed by the server |
CVE-2002-2065 | ".inc" file stored under web document root and returned unparsed by the server |
CVE-2005-2029 | ".inc" file stored under web document root and returned unparsed by the server |
CVE-2001-0330 | direct request to .pl file leaves it unparsed |
CVE-2002-0614 | .inc file |
CVE-2004-2353 | unparsed config.conf file |
CVE-2007-3365 | Chain: uppercase file extensions causes web server to return script source code instead of executing the script. |
Các biện pháp giảm thiểu tiềm năng
Phases : Architecture and DesignPerform a type check before interpreting files.
Phases : Architecture and Design
Do not store sensitive information in files which may be misinterpreted.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Ghi chú
This overlaps direct requests (CWE-425), alternate path (CWE-424), permissions (CWE-275), and sensitive file under web root (CWE-219).Tài liệu tham khảo
REF-62
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh.
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Description, Other_Notes, Relationship_Notes | |
| CWE Content Team | MITRE | updated Description, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Observed_Examples | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities |
