CAPEC Definitions / CAPEC-11
CAPEC-11: Cause Web Server Misclassification
An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process.
Extended Description
This type of vulnerability has been found in many widely used servers including IIS, Lotus Domino, and Orion. The attacker's job in this case is straightforward, standard communication protocols and methods are used and are generally appended with malicious information at the tail end of an otherwise legitimate request. The attack payload varies, but it could be special characters like a period or simply appending a tag that has a special meaning for operations on the server side like .jsp for a java application server. The essence of this attack is that the attacker deceives the server into executing functionality based on the name of the request, i.e. login.jsp, not the contents.
Mitigations
Implementation: Server routines should be determined by content not determined by filename or file extension.
Relationships with other CAPECs
CAPEC-635: Alternative Execution Due to Deceptive Filenames
Prerequisites
Web server software must rely on file name or file extension for processing.
The attacker must be able to make HTTP requests to the web server.
Related Weaknesses
CWE-430: Deployment of Wrong Handler
