CAPEC-11: Cause Web Server Misclassification

MITRE CAPEC attack pattern

Description

An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-430

ATT&CK techniques: T1036.006

Prerequisites

• Web server software must rely on file name or file extension for processing.
• The attacker must be able to make HTTP requests to the web server.

Skills required

• Low: To modify file name or file extension
• Medium: To use misclassification to force the Web server to disclose configuration information, source, or binary data

Consequences

• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Gain Privileges

Mitigations

• Implementation: Server routines should be determined by content not determined by filename or file extension.

Source

• MITRE CAPEC CAPEC-11