CAPEC-11: Cause Web Server Misclassification

Cause Web Server Misclassification

状态:Draft

Typical_Severify: High

攻击可能性:Medium

描述

An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process. This type of vulnerability has been found in many widely used servers including IIS, Lotus Domino, and Orion. The attacker's job in this case is straightforward, standard communication protocols and methods are used and are generally appended with malicious information at the tail end of an otherwise legitimate request. The attack payload varies, but it could be special characters like a period or simply appending a tag that has a special meaning for operations on the server side like .jsp for a java application server. The essence of this attack is that the attacker deceives the server into executing functionality based on the name of the request, i.e. login.jsp, not the contents.

相关攻击模式

ChildOf: CAPEC-635 |Alternative Execution Due to Deceptive Filenames

Execution Flow Attack Setp

Setp 1 Explore

[Footprint file input vectors] Manually or using an automated tool, an attacker searches for all input locations where a user has control over the filenames or MIME types of files submitted to the web server.

Setp 2 Experiment

[File misclassification shotgunning] An attacker makes changes to file extensions and MIME types typically processed by web servers and looks for abnormal behavior.

Setp 3 Experiment

[File misclassification sniping] Understanding how certain file types are processed by web servers, an attacker crafts varying file payloads and modifies their file extension or MIME type to be that of the targeted type to see if the web server is vulnerable to misclassification of that type.

Setp 4 Exploit

[Disclose information] The attacker, by manipulating a file extension or MIME type is able to make the web server return raw information (not executed).

前置条件

Web server software must rely on file name or file extension for processing.

The attacker must be able to make HTTP requests to the web server.

所需技能

Level Low

To modify file name or file extension

Level Medium

To use misclassification to force the Web server to disclose configuration information, source, or binary data

所需资源

None: No specialized resources are required to execute this type of attack.

后果

Scope Impact Likelihood
C o n f i d e n t i a l i t y Read Data
Confidentiality Access Control Authorization Gain Privileges

缓解措施

Implementation: Server routines should be determined by content not determined by filename or file extension.

实例

J2EE application servers are supposed to execute Java Server Pages (JSP). There have been disclosure issues relating to Orion Application Server, where an attacker that appends either a period (.) or space characters to the end of a legitimate Http request, then the server displays the full source code in the attackers' web browser.

http://victim.site/login.jsp.

Since remote data and directory access may be accessed directly from the JSP, this is a potentially very serious issue.

[R.11.2]

相关CWE

430 | 错误句柄的实施

内容历史记录

提交

2014-06-23 | CAPEC Content Team | The MITRE Corporation

修改

2017-01-09 | CAPEC Content Team | The MITRE Corporation

Updated Related_Attack_Patterns

2017-08-04 | CAPEC Content Team | The MITRE Corporation

Updated Attack_Prerequisites, Resources_Required

2018-07-31 | CAPEC Content Team | The MITRE Corporation

Updated Related_Attack_Patterns, Related_Weaknesses

2019-04-04 | CAPEC Content Team | The MITRE Corporation

Updated Related_Weaknesses