Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-433:Unparsed Raw Web Content Delivery
Weakness ID:433
Version:v4.17
Weakness Name:Unparsed Raw Web Content Delivery
Vulnerability Mapping:Allowed
Abstraction:Variant
Structure:Simple
Status:Incomplete
Likelihood of Exploit:
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

▼Extended Description

If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfAllowedV219Storage of File with Sensitive Data Under Web Root
ParentOfAllowedB178Improper Handling of Case Sensitivity
ParentOfAllowedB430Deployment of Wrong Handler
ParentOfAllowedB431Missing Handler
Nature: ChildOf
Mapping: Allowed
Type: Variant
ID: 219
Name: Storage of File with Sensitive Data Under Web Root
Nature: ParentOf
Mapping: Allowed
Type: Base
ID: 178
Name: Improper Handling of Case Sensitivity
Nature: ParentOf
Mapping: Allowed
Type: Base
ID: 430
Name: Deployment of Wrong Handler
Nature: ParentOf
Mapping: Allowed
Type: Base
ID: 431
Name: Missing Handler
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC963SFP Secondary Cluster: Exposed Data
MemberOfProhibitedC1403Comprehensive Categorization: Exposed Resource
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 963
Name: SFP Secondary Cluster: Exposed Data
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1403
Name: Comprehensive Categorization: Exposed Resource
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-294Not Language-Specific Weaknesses
MemberOfProhibitedBSBOSS-328Read Application Data (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-294
Name: Not Language-Specific Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-328
Name: Read Application Data (impact)
▼Relevant To View
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC963SFP Secondary Cluster: Exposed Data
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 963
Name: SFP Secondary Cluster: Exposed Data
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
ConfidentialityN/ARead Application Data
N/A
Scope: Confidentiality
Likelihood: N/A
Impact: Read Application Data
Note:
N/A
▼Potential Mitigations
Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Perform a type check before interpreting files.

Note:

Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Do not store sensitive information in files which may be misinterpreted.

Note:

▼Modes Of Introduction
Phase: Implementation
Note:

N/A

Phase: Operation
Note:

N/A

▼Applicable Platforms
Languages
Class: Not Language-Specific(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

The following code uses an include file to store database credentials:

Language: ( code)
N/A

Language: ( code)
N/A

database.inc

Language: PHP(Bad code)
<?php $dbName = 'usersDB'; $dbPassword = 'skjdh#67nkjd3$3$'; ?>

Language: ( code)
N/A

login.php

Language: PHP(Bad code)
<?php include('database.inc'); $db = connectToDB($dbName, $dbPassword); $db.authenticateUser($username, $password); ?>

Language: ( code)
N/A

If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.

▼Observed Examples
ReferenceDescription
CVE-2002-1886
".inc" file stored under web document root and returned unparsed by the server
CVE-2002-2065
".inc" file stored under web document root and returned unparsed by the server
CVE-2005-2029
".inc" file stored under web document root and returned unparsed by the server
CVE-2001-0330
direct request to .pl file leaves it unparsed
CVE-2002-0614
.inc file
CVE-2004-2353
unparsed config.conf file
CVE-2007-3365
Chain: uppercase file extensions causes web server to return script source code instead of executing the script.
Reference: CVE-2002-1886
Description:
".inc" file stored under web document root and returned unparsed by the server
Reference: CVE-2002-2065
Description:
".inc" file stored under web document root and returned unparsed by the server
Reference: CVE-2005-2029
Description:
".inc" file stored under web document root and returned unparsed by the server
Reference: CVE-2001-0330
Description:
direct request to .pl file leaves it unparsed
Reference: CVE-2002-0614
Description:
.inc file
Reference: CVE-2004-2353
Description:
unparsed config.conf file
Reference: CVE-2007-3365
Description:
Chain: uppercase file extensions causes web server to return script source code instead of executing the script.
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      ▼Detection Methods
      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      Relationship

      This overlaps direct requests (CWE-425), alternate path (CWE-424), permissions (CWE-275), and sensitive file under web root (CWE-219).

      N/A

      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      PLOVERN/AN/AUnparsed Raw Web Content Delivery
      Taxonomy Name: PLOVER
      Entry ID: N/A
      Fit: N/A
      Entry Name: Unparsed Raw Web Content Delivery
      ▼Related Attack Patterns
      IDName
      ▼References
      Reference ID: REF-62
      Title: The Art of Software Security Assessment
      Author: Mark Dowd, John McDonald, Justin Schuh
      Section: Chapter 3, "File Handlers", Page 74
      Publication:
      Publisher:Addison Wesley
      Edition:1st Edition
      URL:
      URL Date:
      Day:N/A
      Month:N/A
      Year:2006
      Details not found