CWE-646 Reliance on File Name or Extension of Externally-Supplied File

The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors.

This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion, causing the wrong action to occur.

• Integrity: Execute Unauthorized Code or Commands — If an attacker can provide a file that is treated as executable, then code execution might be possible. For example, in a web application, an attacker could supply a file that ends in a ".php.gif" extension that appears to be a GIF image, but would be processed as PHP code by the server. • Confidentiality: Read Application Data — An attacker may be able to read sensitive data, e.g., exposure of debug or system data (including application source code) • Availability: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other) — An attacker may be able to cause a denial of service. • Access Control: Gain Privileges or Assume Identity — An attacker may be able to gain privileges.

• [Architecture and Design] Make decisions on the server side based on file content and not on file name or extension.