CAPEC-73: User-Controlled Filename
Description
An attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to pass and exploit these vulnerabilities.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The victim must trust the name and locale of user controlled filenames.
Skills required
- LowTo achieve a redirection and use of less trusted source, an attacker can simply edit data that the host uses to build the filename
- MediumDeploying a malicious look-a-like site (such as a site masquerading as a bank or online auction site) that the user enters their authentication data into.
- HighExploiting a client side vulnerability to inject malicious scripts into the browser's executable process.
Consequences
- ConfidentialityAccess ControlAuthorization
Gain Privileges
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- Availability
Alter Execution Logic
- Confidentiality
Read Data
Mitigations
- Design: Use browser technologies that do not allow client side scripting.
- Implementation: Ensure all content that is delivered to client is sanitized against an acceptable content specification.
- Implementation: Perform input validation for all remote content.
- Implementation: Perform output validation for all remote content.
- Implementation: Disable scripting languages such as JavaScript in browser
- Implementation: Scan dynamically generated content against validation specification
Related weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-86Improper Neutralization of Invalid Characters in Identifiers in Web Pages
- CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- CWE-116Improper Encoding or Escaping of Output
- CWE-184Incomplete List of Disallowed Inputs
- CWE-348Use of Less Trusted Source
- CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
- CWE-697Incorrect Comparison