CWE-433 未加解析的原始Web内容分发
Unparsed Raw Web Content Delivery
结构: Simple
Abstraction: Variant
状态: Incomplete
被利用可能性: unkown
基本描述
The software stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
扩展描述
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.
相关缺陷
- cwe_Nature: ChildOf cwe_CWE_ID: 219 cwe_View_ID: 1000 cwe_Ordinal: Primary
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Confidentiality | Read Application Data |
可能的缓解方案
Architecture and Design
策略:
Perform a type check before interpreting files.
Architecture and Design
策略:
Do not store sensitive information in files which may be misinterpreted.
示例代码
例
The following code uses an include file to store database credentials:
database.inc
bad PHP
$dbPassword = 'skjdh#67nkjd3$3$';
?>
login.php
bad PHP
$db = connectToDB($dbName, $dbPassword);
$db.authenticateUser($username, $password);
?>
If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2002-1886 | ".inc" file stored under web document root and returned unparsed by the server | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1886 |
| CVE-2002-2065 | ".inc" file stored under web document root and returned unparsed by the server | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2065 |
| CVE-2005-2029 | ".inc" file stored under web document root and returned unparsed by the server | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2029 |
| CVE-2001-0330 | direct request to .pl file leaves it unparsed | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0330 |
| CVE-2002-0614 | .inc file | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0614 |
| CVE-2004-2353 | unparsed config.conf file | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2353 |
| CVE-2007-3365 | Chain: uppercase file extensions causes web server to return script source code instead of executing the script. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3365 |
Notes
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Unparsed Raw Web Content Delivery |
引用
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论