Reliance on File Name or Extension of Externally-Supplied File
Weakness ID: 646 (Weakness Variant)Status: Incomplete
+ Description

Description Summary

The software allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

Extended Description

An application might use the file name or extension of of a user-supplied file to determine the proper course of action, such as selecting the correct process to which control should be passed, deciding what data should be made available, or what resources should be allocated. If the attacker can cause the code to misclassify the supplied file, then the wrong action could occur. For example, an attacker could supply a file that ends in a ".php.gif" extension that appears to be a GIF image, but would be processed as PHP code. In extreme cases, code execution is possible, but the attacker could also cause exhaustion of resources, denial of service, information disclosure of debug or system data (including application source code), or being bound to a particular server side process. This weakness may be due to a vulnerability in any of the technologies used by the web and application servers, due to misconfiguration, or resultant from another flaw in the application itself.

+ Time of Introduction
  • Architecture and Design
  • Implementation
  • Operation
+ Applicable Platforms

Languages

All

+ Common Consequences
ScopeEffect
Confidentiality

Information Leakage

Availability

Denial of Service

Access Control

Privilege Escalation

+ Likelihood of Exploit

High

+ Enabling Factors for Exploitation

There is reliance on file name and/or file extension on the server side for processing.

+ Potential Mitigations

Make decisions on the server side based on file content and not on file name or extension.

Properly configure web and applications servers.

Install the latest security patches for all of the technologies being used on the server side.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class345Insufficient Verification of Data Authenticity
Development Concepts (primary)699
Research Concepts (primary)1000
ChildOfCategoryCategory442Web Problems
Development Concepts699
+ Related Attack Patterns
CAPEC-IDAttack Pattern Name
(CAPEC Version: 1.4)
209Cross-Site Scripting Using MIME Type Mismatch
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2008-01-30Evgeny LebanidzeCigitalExternal Submission
Modifications
Modification DateModifierOrganizationSource
2008-09-08CWE Content TeamMITREInternal
updated Common Consequences, Relationships, Observed Example
2008-10-13CWE Content TeamMITREInternal
Significant clarification of the weakness description.
2008-10-14CWE Content TeamMITREInternal
updated Description, Name, Observed Examples, Relationships
2009-07-27CWE Content TeamMITREInternal
updated Related Attack Patterns
2009-10-29CWE Content TeamMITREInternal
updated Common Consequences
Previous Entry Names
Change DatePrevious Entry Name
2008-10-14Taking Actions based on File Name or Extension of a User Supplied File