CWE-644
Improper Neutralization of HTTP Headers for Scripting Syntax
2008-01-30
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Improper Neutralization of HTTP Headers for Scripting Syntax
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
Thông tin chung
Các cách xuất hiện
ImplementationNền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Công nghệ
Lớp: Web Based (Undetermined)Tên: Web Server (Undetermined)
Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Integrity Confidentiality Availability | Execute Unauthorized Code or Commands Ghi chú: The header may contain a script that will get executed in the client's browser context, potentially resulting in a cross site scripting vulnerability or possibly an HTTP response splitting attack. | |
| Confidentiality | Read Application Data Ghi chú: Attackers may be able to obtain sensitive information. |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2006-3918 | Web server does not remove the Expect header from an HTTP request when it is reflected back in an error message, allowing a Flash SWF file to perform XSS attacks. |
Các biện pháp giảm thiểu tiềm năng
Phases : Architecture and DesignCarefully control data that is being placed both in HTTP response headers and in the HTTP response body to ensure that no scripting syntax is present, taking various encodings into account. Perform output validation in order to filter/escape/encode unsafe data that is being passed from the server in an HTTP response header.
Phases : Architecture and Design
Disable script execution functionality in the clients' browser.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| Evgeny Lebanidze | Cigital | Draft 8 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| Sean Eidemiller | Cigital | added/updated demonstrative examples | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Observed_Example | |
| CWE Content Team | MITRE | updated Description, Name, Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description, Name | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Description, Name | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Observed_Examples | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Enabling_Factors_for_Exploitation | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Potential_Mitigations |
