CAPEC-11

Detailed Abstraction Level
Meta — Very abstract, high-level category
Standard — Specific enough to understand
Detailed — Tied to specific technique Draft MITRE CAPEC Status
Stable — Fully reviewed and complete
Draft — Under development
Incomplete — Partially defined
Deprecated — No longer recommended
Obsolete — Replaced by another CAPEC Likelihood: Medium Severity: High
Cause Web Server Misclassification

Description

An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process.

Prerequisites

Web server software must rely on file name or file extension for processing.

The attacker must be able to make HTTP requests to the web server.

Mitigations

Implementation: Server routines should be determined by content not determined by filename or file extension.

Skills Required

[Low] To modify file name or file extension

[Medium] To use misclassification to force the Web server to disclose configuration information, source, or binary data