CWE-428 Detail

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.

Modes Of Introduction

Implementation

Piattaforme applicabili

Linguaggio

Class: Not Language-Specific (Undetermined)

Sistemi operativi

Name: Windows NT (Sometimes)
Name: macOS (Rarely)

Conseguenze comuni

Esempi osservati

Potential Mitigations

Phases : Implementation
Properly quote the full search path before executing a program on the system.
Phases : Implementation
Phases : Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Note sulla mappatura delle vulnerabilità

Giustificazione : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commento : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Note

Riferimenti

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

Invio

Modifiche