Tên: Reliance on File Name or Extension of Externally-Supplied File

The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors.

Mô tả CWE

This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion, causing the wrong action to occur.

Thông tin chung

Các cách xuất hiện

Array : An application might use the file name or extension of a user-supplied file to determine the proper course of action, such as selecting the correct process to which control should be passed, deciding what data should be made available, or what resources should be allocated.

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Công nghệ

Tên: Web Server (Undetermined)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Integrity	Execute Unauthorized Code or Commands Ghi chú: If an attacker can provide a file that is treated as executable, then code execution might be possible. For example, in a web application, an attacker could supply a file that ends in a ".php.gif" extension that appears to be a GIF image, but would be processed as PHP code by the server.
Confidentiality	Read Application Data Ghi chú: An attacker may be able to read sensitive data, e.g., exposure of debug or system data (including application source code)
Availability	DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other) Ghi chú: An attacker may be able to cause a denial of service.
Access Control	Gain Privileges or Assume Identity Ghi chú: An attacker may be able to gain privileges.

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Make decisions on the server side based on file content and not on file name or extension.

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Mẫu tấn công liên quan

ID CAPEC	Tên mẫu tấn công
CAPEC-209	XSS Using MIME Type Mismatch An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's script may run on the target unsanitized, possibly revealing the victim's cookies or executing arbitrary script in their browser.

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
Evgeny Lebanidze	Cigital	2008-01-30 +00:00	2008-01-30 +00:00	Draft 8

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Observed_Example
CWE Content Team	MITRE	2008-10-13 +00:00	Significant clarification of the weakness description.
CWE Content Team	MITRE	2008-10-14 +00:00	updated Description, Name, Observed_Examples, Relationships
CWE Content Team	MITRE	2009-07-27 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2009-10-29 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2010-12-13 +00:00	updated Applicable_Platforms, Common_Consequences
CWE Content Team	MITRE	2011-03-29 +00:00	updated Common_Consequences, Description
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Enabling_Factors_for_Exploitation
CWE Content Team	MITRE	2020-02-24 +00:00	updated Applicable_Platforms, Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Description, Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction, Type, Weakness_Ordinalities

Chi tiết CWE-646

CWE-646