CWE-433: Unparsed Raw Web Content Delivery
Official CWE-433 CWE context with Glexia analysis, remediation guidance, related CVEs, and ATT&CK context.
Glexia's Take
CWE-433: Unparsed Raw Web Content Delivery
Unparsed Raw Web Content Delivery represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Confidentiality: Read Application Data
Developer Pattern
CWE-433 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Confidence
high confidence from CWE-433, 4.20.
Official CWE Definition
CWE-433: Unparsed Raw Web Content Delivery
The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- The following code uses an include file to store database credentials: database.inc,login.php,If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.
Remediation
- Architecture and Design: Perform a type check before interpreting files.
- Architecture and Design: Do not store sensitive information in files which may be misinterpreted.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.