1046
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding SIG00-C Mask signals handled by
noninterruptible signal handlers
PLOVER Dangerous handler not cleared/
disabled during sensitive operations
CWE-433: Unparsed Raw Web Content Delivery
Weakness ID : 433
Structure : Simple
Abstraction : Variant
Description
The product stores raw content or supporting code under the web document root with an extension
that is not specifically handled by the server.
Extended Description
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does
not have a handler for that extension, then the server will likely send the contents of the file
directly to the requester without the pre-processing that was expected. When that file contains
sensitive information such as database credentials, this may allow the attacker to compromise the
application or associated components.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 219 Storage of File with Sensitive Data Under Web Root 553
CanFollow 178 Improper Handling of Case Sensitivity 445
CanFollow 430 Deployment of Wrong Handler 1042
CanFollow 431 Missing Handler 1043
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Potential Mitigations
Phase: Architecture and Design
Perform a type check before interpreting files.
Phase: Architecture and Design
Do not store sensitive information in files which may be misinterpreted.
Demonstrative Examples
Example 1:
The following code uses an include file to store database credentials:
CWE Version 4.14
CWE-433: Unparsed Raw Web Content Delivery
CWE-433: Unparsed Raw Web Content Delivery