Home > CAPEC List > CAPEC-11: Cause Web Server Misclassification (Version 3.0)  

CAPEC-11: Cause Web Server Misclassification

Attack Pattern ID: 11
Abstraction: Detailed
Status: Draft
Presentation Filter:
+ Description
An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process. This type of vulnerability has been found in many widely used servers including IIS, Lotus Domino, and Orion. The attacker's job in this case is straightforward, standard communication protocols and methods are used and are generally appended with malicious information at the tail end of an otherwise legitimate request. The attack payload varies, but it could be special characters like a period or simply appending a tag that has a special meaning for operations on the server side like .jsp for a java application server. The essence of this attack is that the attacker deceives the server into executing functionality based on the name of the request, i.e. login.jsp, not the contents.
+ Likelihood Of Attack

Medium

+ Typical Severity

High

+ Relationships

The table(s) below shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.

+ Relevant to the view "Mechanisms of Attack" (CAPEC-1000)
NatureTypeIDName
ChildOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.635Alternative Execution Due to Deceptive Filenames
+ Execution Flow
Explore
  1. Footprint file input vectors: Manually or using an automated tool, an attacker searches for all input locations where a user has control over the filenames or MIME types of files submitted to the web server. Attacker manually crawls application to identify file inputs Attacker uses an automated tool to crawl application identify file inputs Attacker manually assesses strength of access control protecting native application files from user control Attacker explores potential for submitting files directly to the web server via independently constructed HTTP Requests

    Techniques
    Attacker manually crawls application to identify file inputs
    Attacker uses an automated tool to crawl application identify file inputs
    Attacker manually assesses strength of access control protecting native application files from user control
    Attacker explores potential for submitting files directly to the web server via independently constructed HTTP Requests
Experiment
  1. File misclassification shotgunning: An attacker makes changes to file extensions and MIME types typically processed by web servers and looks for abnormal behavior. Attacker submits files with switched extensions (e.g. .php on a .jsp file) to web server. Attacker adds extra characters (e.g. adding an extra . after the file extension) to filenames of files submitted to web server.

    Techniques
    Attacker submits files with switched extensions (e.g. .php on a .jsp file) to web server.
    Attacker adds extra characters (e.g. adding an extra . after the file extension) to filenames of files submitted to web server.
  2. File misclassification sniping: Understanding how certain file types are processed by web servers, an attacker crafts varying file payloads and modifies their file extension or MIME type to be that of the targeted type to see if the web server is vulnerable to misclassification of that type. Craft a malicious file payload, modify file extension to the targeted file type and submit it to the web server. Craft a malicious file payload, modify its associated MIME type to the targeted file type and submit it to the web server.

    Techniques
    Craft a malicious file payload, modify file extension to the targeted file type and submit it to the web server.
    Craft a malicious file payload, modify its associated MIME type to the targeted file type and submit it to the web server.
Exploit
  1. Disclose information: The attacker, by manipulating a file extension or MIME type is able to make the web server return raw information (not executed). Manipulate the file names that are explicitly sent to the server. Manipulate the MIME sent in order to confuse the web server.

    Techniques
    Manipulate the file names that are explicitly sent to the server.
    Manipulate the MIME sent in order to confuse the web server.
+ Prerequisites
Web server software must rely on file name or file extension for processing.
The attacker must be able to make HTTP requests to the web server.
+ Skills Required
[Level: Low]
To modify file name or file extension
[Level: Medium]
To use misclassification to force the Web server to disclose configuration information, source, or binary data
+ Resources Required
None: No specialized resources are required to execute this type of attack.
+ Consequences

The table below specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Confidentiality
Read Data
Confidentiality
Access Control
Authorization
Gain Privileges
+ Mitigations
Implementation: Server routines should be determined by content not determined by filename or file extension.
+ Example Instances

J2EE application servers are supposed to execute Java Server Pages (JSP). There have been disclosure issues relating to Orion Application Server, where an attacker that appends either a period (.) or space characters to the end of a legitimate Http request, then the server displays the full source code in the attackers' web browser.

http://victim.site/login.jsp.

Since remote data and directory access may be accessed directly from the JSP, this is a potentially very serious issue.

[R.11.2]

+ References
[REF-1] G. Hoglund and G. McGraw. "Exploiting Software: How to Break Code". Addison-Wesley. 2004-02.
[REF-6] "Orion Application Server JSP Source Disclosure Vulnerability (Bugtraq ID: 17204)". SecurityFocus. <http://www.securityfocus.com/bid/17204/info>.
+ Content History
Submissions
Submission DateSubmitterOrganization
2014-06-23CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2017-01-09CAPEC Content TeamThe MITRE Corporation
Updated Related_Attack_Patterns
2017-08-04CAPEC Content TeamThe MITRE Corporation
Updated Attack_Prerequisites, Resources_Required
2018-07-31CAPEC Content TeamThe MITRE Corporation
Updated Related_Attack_Patterns, Related_Weaknesses

More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 31, 2018