CAPEC-11

This type of vulnerability has been found in many widely used servers including IIS, Lotus Domino, and Orion. The attacker's job in this case is straightforward, standard communication protocols and methods are used and are generally appended with malicious information at the tail end of an otherwise legitimate request. The attack payload varies, but it could be special characters like a period or simply appending a tag that has a special meaning for operations on the server side like .jsp for a java application server. The essence of this attack is that the attacker deceives the server into executing functionality based on the name of the request, i.e. login.jsp, not the contents.

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Footprint file input vectors] Manually or using an automated tool, an attacker searches for all input locations where a user has control over the filenames or MIME types of files submitted to the web server.

      4 techniques

      • Attacker manually crawls application to identify file inputs
      • Attacker uses an automated tool to crawl application identify file inputs
      • Attacker manually assesses strength of access control protecting native application files from user control
      • Attacker explores potential for submitting files directly to the web server via independently constructed HTTP Requests

2. Experiment

   They probe what they found.

   2. [File misclassification shotgunning] An attacker makes changes to file extensions and MIME types typically processed by web servers and looks for abnormal behavior.

      2 techniques

      • Attacker submits files with switched extensions (e.g. .php on a .jsp file) to web server.
      • Attacker adds extra characters (e.g. adding an extra . after the file extension) to filenames of files submitted to web server.

   3. [File misclassification sniping] Understanding how certain file types are processed by web servers, an attacker crafts varying file payloads and modifies their file extension or MIME type to be that of the targeted type to see if the web server is vulnerable to misclassification of that type.

      2 techniques

      • Craft a malicious file payload, modify file extension to the targeted file type and submit it to the web server.
      • Craft a malicious file payload, modify its associated MIME type to the targeted file type and submit it to the web server.

3. Exploit

   They carry out the attack.

   4. [Disclose information] The attacker, by manipulating a file extension or MIME type is able to make the web server return raw information (not executed).

      2 techniques

      • Manipulate the file names that are explicitly sent to the server.
      • Manipulate the MIME sent in order to confuse the web server.

Prerequisites

• Web server software must rely on file name or file extension for processing.

• The attacker must be able to make HTTP requests to the web server.

Skills required

• Low skill

  To modify file name or file extension

• Medium skill

  To use misclassification to force the Web server to disclose configuration information, source, or binary data

Resources required

• None: No specialized resources are required to execute this type of attack.

Consequences

Mitigations

• Implementation: Server routines should be determined by content not determined by filename or file extension.

Weaknesses it exploits

• CWE-430 Deployment of Wrong Handler

Recent CVEs with these weaknesses

1. 3.7CVE-2026-423562026-10-01

   Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no ot…

2. 8.2CVE-2025-39462025-07-10

   The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Mani…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-635 Alternative Execution Due to Deceptive Filenames

Examples

MITRE's words, unchanged: CAPEC-11 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.