CWE-430 means the wrong handler is assigned to process an object. MITRE's examples: a servlet called to reveal the source of a JSP file, or code that decides an object's type automatically even when it contradicts an explicitly specified type.
How it happens
Systems pick a handler from hints such as file extension, Content-Type header or request path. If an attacker can steer those hints, a different component processes the content than the designers expected.
The observed examples show several versions:
- Source disclosure through a manipulated file extension that sent the file to the wrong DLL (CVE-2001-0004).
- A browser mishandling the Content-Type header so a different application processed the document (CVE-2002-0025).
- Source disclosure by directly invoking a servlet (CVE-2000-1052).
- Loading arbitrary Perl functions by calling a non-existent function that activated a handler (CVE-2002-1742).
What an attacker gains
The record lists integrity impact and an unexpected state, varying by context. In the examples, that meant reading source code and reaching code that was never meant to be exposed.
How to find it
No detection methods are listed. Review how your system chooses handlers. Test with odd extensions, mixed case, mismatched Content-Type and direct requests to internal components.
How to fix it
- Choose handlers from trusted, explicit configuration, not from attacker influenced hints.
- When a type is specified, honor it, and reject mismatches instead of guessing.
- Do not expose internal handlers, servlets or helpers to direct requests.
- Keep source and supporting code outside the web root.
A defensive habit
When your system routes content to a handler, log which handler was chosen and why. Surprises show up quickly: a file with a double extension sent to the script engine, or a request that reached an internal servlet. Logging turns a silent mismatch into something you can alert on.
Quick check
Which hints should you distrust?
File extension, Content-Type and request path are all client influenced. Treat them as claims to verify.
