|
|
|
|
CWE-434: Unrestricted File Upload | |
| | Unrestricted File Upload |
Definition in a New Window 
|
| Compound Element ID: 434 (Compound Element Base: Composite) | | Status: Draft |
 Description
Description Summary The software allows the attacker to upload or transfer files of
dangerous types that can be automatically processed within the product's
environment.
Alternate Terms
| File Upload of Dangerous Type: | Formerly called "File Upload of Dangerous Type" |
|---|
Time of Introduction Observed Examples Potential Mitigations | Phase | Description |
|---|
| Determine the size and type of files that users are expected to upload
to your system. Take measures to assure that the files meet those
requirements. |
Other Notes
|
This can have a chaining relationship with incomplete blacklist /
permissive whitelist errors when the product tries, but fails, to properly
limit which types of files are allowed.
This can also overlap multiple interpretation errors for intermediaries,
e.g. anti-virus products that do not filter attachments with certain file
extensions that can be processed by client systems.
This can be primary when there is no check at all. If is frequently
resultant when use of double extensions (e.g. ".php.gif") bypass sanity
checks. Also resultant from client-side enforcement; some products will
include web script in web clients to check the filename, without verifying
on the server side.
|
Relationships Research Gaps
|
PHP applications are most targeted, but this likely applies to other
languages that support file upload, as well as non-web technologies. ASP
applications have also demonstrated this problem.
|
Affected Resources Taxonomy Mappings | Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|
| PLOVER | | | Unrestricted File Upload |
| OWASP Top Ten 2007 | A3 | CWE More Specific | Malicious File Execution |
References Content History | Submissions |
|---|
| Submission Date | Submitter | Organization | Source |
|---|
| PLOVER | | Externally Mined | | | Modifications |
|---|
| Modification Date | Modifier | Organization | Source |
|---|
| 2008-07-01 | Eric Dalci | Cigital | External | | updated Time of Introduction | | 2008-09-08 | CWE Content Team | MITRE | Internal | | updated Alternate Terms, Relationships, Other Notes,
Taxonomy Mappings | | 2009-01-12 | CWE Content Team | MITRE | Internal | | updated Relationships |
|
