Weakness · Medium
CWE-430: Deployment of Wrong Handler
What it is
The wrong "handler" is assigned to process an object.
- Severity (our rating)
- Medium
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
An example of deploying the wrong handler would be calling a servlet to reveal source code of a .JSP file, or automatically "determining" type of the object even if it is contradictory to an explicitly specified type.
What an attacker can do
- Varies by Context (Integrity, Other)
- Unexpected State (Integrity, Other)
How to prevent it
Architecture and Design
- Perform a type check before interpreting an object.
- Reject any inconsistent types, such as a file with a .GIF extension that appears to consist of PHP code.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.