R040. Compare file format and extension

Requirement

The system must validate that the format (structure) of the files corresponds to their extension.

References

  1. CAPEC-11: Cause Web Server Misclassification. An attack of this type exploits a Web server’s decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence.

  2. CAPEC-165: File Manipulation. An attacker modifies file contents or attributes (such as extensions or names) of files in a manner to cause incorrect processing by an application.

  3. CWE-434: Unrestricted Upload of File with Dangerous Type. The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product’s environment.

  4. CWE-646: Reliance on File Name or Extension of Externally-Supplied File. The software allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

  5. OWASP-ASVS v4.0.1 V12.2 File Integrity Requirements.(12.2.1) Verify that files obtained from untrusted sources are validated to be of expected type based on the file’s content.

Copyright © 2020 Fluid Attacks, We hack your software. All rights reserved.

Service status - Terms of Use - Privacy Policy - Cookie Policy