1048
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-434: Unrestricted Upload of File with Dangerous Type
Weakness ID : 434
Structure : Simple
Abstraction : Base
Description
The product allows the attacker to upload or transfer files of dangerous types that can be
automatically processed within the product's environment.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 669 Incorrect Resource Transfer Between Spheres 1471
PeerOf 351 Insufficient Type Distinction 866
PeerOf 430 Deployment of Wrong Handler 1042
PeerOf 436 Interpretation Conflict 1057
PeerOf 430 Deployment of Wrong Handler 1042
CanFollow 73 External Control of File Name or Path 132
CanFollow 183 Permissive List of Allowed Inputs 458
CanFollow 184 Incomplete List of Disallowed Inputs 459
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 669 Incorrect Resource Transfer Between Spheres 1471
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 429 Handler Errors 2326
Weakness Ordinalities
Primary : This can be primary when there is no check at all.
Resultant : This is frequently resultant when use of double extensions (e.g. ".php.gif")
bypasses a sanity check.
Resultant : This can be resultant from client-side enforcement (CWE-602); some products
will include web script in web clients to check the filename, without verifying on the server
side.
Applicable Platforms
CWE Version 4.14
CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-434: Unrestricted Upload of File with Dangerous Type