CAPEC-11: Cause Web Server Misclassification
Description
An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- Web server software must rely on file name or file extension for processing.
- The attacker must be able to make HTTP requests to the web server.
Skills required
- LowTo modify file name or file extension
- MediumTo use misclassification to force the Web server to disclose configuration information, source, or binary data
Consequences
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Implementation: Server routines should be determined by content not determined by filename or file extension.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SJAScheduled Job Analysis1 shared
- D3-SFASystem File Analysis1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-SCFSystem Call Filtering1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.