What is Reliance on File Name or Extension (CWE-646)?

TL;DR: Reliance on File Name or Extension of Externally-Supplied File (CWE-646) is a vulnerability where files are processed based on their name or extension, leading to security risks. Fix it by verifying file content instead.

What is Reliance on File Name or Extension of Externally-Supplied File?

Reliance on File Name or Extension of Externally-Supplied File (CWE-646) is a type of Insecure Design vulnerability that occurs when an application processes files based solely on their names or extensions, rather than verifying the actual content. As defined by the MITRE Corporation under CWE-646, and classified by the OWASP Foundation under A06:2025 - Insecure Design…

Quick Summary

Reliance on File Name or Extension of Externally-Supplied File is a critical security flaw where applications rely on file names or extensions to determine how files should be processed. This can lead to misclassification and dangerous behaviors, such as unauthorized access to sensitive data, denial-of-service attacks, and privilege escalation.

Jump to: Quick Summary · Reliance on File Name or Extension of Externally-Supplied File Overview · How Reliance on File Name or Extension of Externally-Supplied File Works · Business Impact of Reliance on File Name or Extension of Externally-Supplied File · Reliance on File Name or Extension of Externally-Supplied File Attack Scenario · How to Detect Reliance on File Name or Extension of Externally-Supplied File · How to Fix Reliance on File Name or Extension of Externally-Supplied File · Framework-Specific Fixes for Reliance on File Name or Extension of Externally-Supplied File · How to Ask AI to Check Your Code for Reliance on File Name or Extension of Externally-Supplied File · Reliance on File Name or Extension of Externally-Supplied File Best Practices Checklist · Reliance on File Name or Extension of Externally-Supplied File FAQ · Vulnerabilities Related to Reliance on File Name or Extension of Externally-Supplied File · References · Scan Your Own Site

Reliance on File Name or Extension of Externally-Supplied File Overview

What

Reliance on File Name or Extension of Externally-Supplied File occurs when an application processes file uploads based solely on the names or extensions provided by users, rather than verifying the actual content.

Why it Matters

This vulnerability allows attackers to misclassify files and trigger dangerous behaviors, such as unauthorized access to sensitive data, denial-of-service attacks, and privilege escalation.

Where It Occurs

It commonly occurs in web applications that accept file uploads from untrusted sources without proper validation of file contents.

Who Is Affected

Web application developers who rely on file names or extensions for processing uploaded files are at risk.

Who Is NOT Affected

Applications that verify file content before processing and do not depend on file names or extensions to determine behavior.

How Reliance on File Name or Extension of Externally-Supplied File Works

Root Cause

The root cause is the lack of robust validation for uploaded files, leading to decisions based solely on file names or extensions rather than actual content.

Attack Flow

1. An attacker uploads a malicious file with a benign-looking name or extension.
2. The application processes the file based on its name or extension.
3. The misclassified file triggers dangerous behaviors, such as reading sensitive data or causing a denial-of-service attack.

Prerequisites to Exploit

• The application must accept and process files without verifying their content.
• Attackers need access to upload malicious files with misleading names/extensions.

Vulnerable Code

def handle_file_upload(file):
    filename = file.filename
    if filename.endswith('.txt'):
        # Process as text file
        ...

This code relies on the file extension .txt to determine how to process the uploaded file, without validating its actual content.

Secure Code

import magic

def handle_file_upload(file):
    mime_type = magic.from_buffer(file.read(), mime=True)
    if mime_type == 'text/plain':
        # Process as text file
        ...

This code uses a library like magic to determine the MIME type of the uploaded file based on its content, ensuring proper validation before processing.

Business Impact of Reliance on File Name or Extension of Externally-Supplied File

Confidentiality

• Data Exposure: Attackers can read sensitive data by misclassifying files as benign.
• Financial loss due to unauthorized access and potential data breaches.
• Compliance issues with regulations like GDPR, HIPAA, and PCI DSS.

Availability

• Denial of Service (DoS): Misclassified files can cause application crashes or resource exhaustion.
• Increased downtime leading to revenue losses and customer dissatisfaction.
• Reputation damage from service disruptions.

Integrity

• Data Corruption: Attackers may modify data by misclassifying files as writable.
• Loss of trust in the system’s integrity, leading to decreased user confidence.

Reliance on File Name or Extension of Externally-Supplied File Attack Scenario

1. An attacker uploads a file named sensitive_data.txt with a malicious payload disguised as text content.
2. The application processes this file based on its name and extension, treating it as a benign text file.
3. The misclassified file triggers the application to read sensitive data from an unauthorized location.

How to Detect Reliance on File Name or Extension of Externally-Supplied File

Manual Testing

• Check if uploaded files are processed based solely on their names or extensions.
• Verify that file content is validated before any processing occurs.

Automated Scanners (SAST / DAST)

Static analysis can detect code patterns where file names or extensions are used to determine behavior. Dynamic testing can simulate attacks by uploading files with misleading names/extensions and observing the application’s response.

PenScan Detection

PenScan uses engines like ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap to identify reliance on file name or extension vulnerabilities during automated scans.

False Positive Guidance

A false positive occurs when a benign code pattern is flagged as risky. Ensure that the application actually processes files based on names/extensions without proper content validation before marking it as vulnerable.

How to Fix Reliance on File Name or Extension of Externally-Supplied File

• Make decisions based on file content, not just name or extension.
• Use server-side validation to check and verify uploaded files’ actual contents.
• Implement robust MIME type detection for uploaded files.
• Reject any file that cannot be properly validated before processing.

Framework-Specific Fixes for Reliance on File Name or Extension of Externally-Supplied File

Java

import java.nio.file.Files;
import java.nio.file.Path;

public void handleFileUpload(MultipartFile file) throws IOException {
    Path tempPath = Files.createTempFile("temp", ".txt");
    try (InputStream in = file.getInputStream()) {
        Files.copy(in, tempPath);
    }
    
    String mimeType = Files.probeContentType(tempPath);
    if ("text/plain".equals(mimeType)) {
        // Process as text file
        ...
    }
}

Node.js

const fs = require('fs');
const fileType = require('file-type');

app.post('/upload', (req, res) => {
    const buffer = req.files.file.data;
    const type = fileType(buffer);
    
    if (type && type.mime === 'text/plain') {
        // Process as text file
        ...
    }
});

Python/Django

from django.core.exceptions import ValidationError

def handle_file_upload(file):
    mime_type = magic.from_buffer(file.read(), mime=True)
    if mime_type != 'text/plain':
        raise ValidationError('Invalid file type')
    
    # Process as text file
    ...

PHP

require_once 'vendor/autoload.php';

use Symfony\Component\HttpFoundation\File\UploadedFile;

public function upload(UploadedFile $file) {
    $mimeType = finfo_file(finfo_open(FILEINFO_MIME_TYPE), $file->getRealPath());
    
    if ($mimeType !== 'text/plain') {
        throw new \Exception('Invalid file type');
    }
    
    // Process as text file
    ...
}

How to Ask AI to Check Your Code for Reliance on File Name or Extension of Externally-Supplied File

Review the following Python code block for potential CWE-646 Reliance on File Name or Extension of Externally-Supplied File vulnerabilities and rewrite it using server-side validation: [paste code here]

Reliance on File Name or Extension of Externally-Supplied File Best Practices Checklist

✅ Ensure file content is validated before processing. ✅ Use MIME type detection libraries to verify uploaded files’ actual types. ✅ Reject any file that cannot be properly validated. ✅ Implement robust checks for file names and extensions, but prioritize content validation. ✅ Regularly review and update your application’s file handling logic.

Reliance on File Name or Extension of Externally-Supplied File FAQ

How does reliance on file name or extension lead to security vulnerabilities?

It allows attackers to misclassify files, leading to dangerous processing.

What are the typical consequences of relying on file names or extensions?

Attackers may read sensitive data, cause a denial of service, or gain privileges.

Can you provide an example of vulnerable code for this weakness?

Code that uses file name to determine behavior without verifying content is vulnerable.

How can I detect reliance on file names or extensions in my application?

Manual testing involves checking how files are processed based on their names or extensions.

What is the best practice to prevent this vulnerability?

Make decisions server-side based on file content, not just name or extension.

How does reliance on file names impact availability?

Attackers can cause a denial of service by misclassifying files and triggering crashes.

What are the common mitigations for this vulnerability in web applications?

Use server-side validation to check file content, not just name or extension.

Vulnerabilities Related to Reliance on File Name or Extension of Externally-Supplied File

References

• MITRE
• OWASP
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Reliance on File Name or Extension of Externally-Supplied File and other risks before an attacker does.