CWE-433 未加解析的原始Web内容分发

Unparsed Raw Web Content Delivery

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

The software stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

扩展描述

If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 219 cwe_View_ID: 1000 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Confidentiality Read Application Data

可能的缓解方案

Architecture and Design

策略:

Perform a type check before interpreting files.

Architecture and Design

策略:

Do not store sensitive information in files which may be misinterpreted.

示例代码

例

The following code uses an include file to store database credentials:

database.inc

bad PHP

<?php
$dbName = 'usersDB';
$dbPassword = 'skjdh#67nkjd3$3$';
?>

login.php

bad PHP

<?php
include('database.inc');
$db = connectToDB($dbName, $dbPassword);
$db.authenticateUser($username, $password);
?>

If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.

分析过的案例

标识 说明 链接
CVE-2002-1886 ".inc" file stored under web document root and returned unparsed by the server https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1886
CVE-2002-2065 ".inc" file stored under web document root and returned unparsed by the server https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2065
CVE-2005-2029 ".inc" file stored under web document root and returned unparsed by the server https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2029
CVE-2001-0330 direct request to .pl file leaves it unparsed https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0330
CVE-2002-0614 .inc file https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0614
CVE-2004-2353 unparsed config.conf file https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2353
CVE-2007-3365 Chain: uppercase file extensions causes web server to return script source code instead of executing the script. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3365

Notes

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Unparsed Raw Web Content Delivery

引用