Szczegóły CWE-61

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

A product that allows UNIX symbolic links (symlink) as part of paths whether in internal code or through user input can allow an attacker to spoof the symbolic link and traverse the file system to unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/write/corrupt a file that they originally did not have permissions to access.

Sposoby wprowadzenia

Implementation : These are typically reported for temporary files or privileged programs.

Odpowiednie platformy

Język

Class: Not Language-Specific (Undetermined)

Typowe konsekwencje

Zaobserwowane przykłady

Potencjalne środki zaradcze

Phases : Implementation
Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
Phases : Architecture and Design

Metody wykrywania

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Uwagi dotyczące mapowania podatności

Uzasadnienie : This is a well-known Composite of multiple weaknesses that must all occur simultaneously, although it is attack-oriented in nature.
Komentarz : While attack-oriented composites are supported in CWE, they have not been a focus of research. There is a chance that future research or CWE scope clarifications will change or deprecate them. Perform root-cause analysis to determine which weaknesses allow symlink following to occur, and map to those weaknesses. For example, predictable file names might be intended functionality, but creation in a directory with insecure permissions might not.

Powiązane wzorce ataków

Notatki

Odniesienia

REF-493

Second-Order Symlink Vulnerabilities
Steve Christey.
https://seclists.org/bugtraq/2005/Jun/44

REF-494

Crafting Symlinks for Fun and Profit
Shaun Colley.
https://web.archive.org/web/20040502153535/http://www.infosecwriters.com/texts.php?op=display&id=159

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

Zgłoszenie

Modyfikacje