CWE-427 Detalhe

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Modos de Introdução

Implementation

Plataformas Aplicáveis

Linguagem

Class: Not Language-Specific (Undetermined)

Sistemas Operacionais

Class: Not OS-Specific (Undetermined)

Tecnologias

Class: Not Technology-Specific (Undetermined)

Consequências Comuns

Exemplos Observados

Mitigações Potenciais

Phases : Architecture and Design // Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Phases : Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Phases : Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Phases : Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
Phases : Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.

Métodos de Detecção

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Eficácia : High

Notas de Mapeamento de Vulnerabilidade

Justificativa : This CWE entry is often confused with another closely-related entry about search paths.
Comentário : CWE-426 and CWE-427 are often misused because they both mention search paths, although CWE-426 is focused on attacker control of the search path itself, while CWE-427 applies when the attacker cannot modify the search path but can write to one of the locations specified in the search path. Also, this entry is classified in a part of CWE's hierarchy that does not have sufficiently low-level coverage, which might reflect a lack of classification-oriented weakness research in the software security community. Conduct careful root cause analysis to determine the original mistake that led to this weakness. If closer analysis reveals that this weakness is appropriate, then this might be the best available CWE to use for mapping. If no other option is available, then it is acceptable to map to this CWE.

Padrões de Ataque Relacionados

Notas

Unlike untrusted search path (CWE-426), which inherently involves control over the definition of a control sphere (i.e., modification of a search path), this entry concerns a fixed control sphere in which some part of the sphere may be under attacker control (i.e., the search path cannot be modified by an attacker, but one element of the path can be under attacker control).
This weakness is not a clean fit under CWE-668 or CWE-610, which suggests that the control sphere model might need enhancement or clarification.

Referências

REF-409

Double clicking on MS Office documents from Windows Explorer may execute arbitrary programs in some cases
Georgi Guninski.
https://seclists.org/bugtraq/2000/Sep/331

REF-410

ACROS Security: Remote Binary Planting in Apple iTunes for Windows (ASPR #2010-08-18-1)
Mitja Kolsek.
https://lists.openwall.net/bugtraq/2010/08/18/4

REF-411

Automatic Detection of Vulnerable Dynamic Component Loadings
Taeho Kwon, Zhendong Su.
https://dl.acm.org/doi/10.1145/1831708.1831722

REF-412

Dynamic-Link Library Search Order
https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN

REF-413

Dynamic-Link Library Security
https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security

REF-414

An update on the DLL-preloading remote attack vector
https://msrc.microsoft.com/blog/2010/08/an-update-on-the-dll-preloading-remote-attack-vector/

REF-415

Insecure Library Loading Could Allow Remote Code Execution
https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637#insecure-library-loading-could-allow-remote-code-execution

REF-416

Application DLL Load Hijacking
HD Moore.
https://www.rapid7.com/blog/?p=5325

REF-417

DLL Hijacking: Facts and Fiction
Oliver Lavery.
https://threatpost.com/dll-hijacking-facts-and-fiction-082610/74384/

REF-1168

Microsoft warns enterprises of new 'dependency confusion' attack technique
Catalin Cimpanu.
https://www.zdnet.com/article/microsoft-warns-enterprises-of-new-dependency-confusion-attack-technique/

REF-1169

Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies
Alex Birsan.
https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

REF-1170

3 Ways to Mitigate Risk When Using Private Package Feeds
Microsoft.
https://azure.microsoft.com/mediahandler/files/resourcefiles/3-ways-to-mitigate-risk-using-private-package-feeds/3%20Ways%20to%20Mitigate%20Risk%20When%20Using%20Private%20Package%20Feeds%20-%20v1.0.pdf

REF-1325

exec package - os/exec - Go Packages
https://pkg.go.dev/os/exec

REF-1326

Git LFS Changelog
Brian M. Carlson.
https://github.com/git-lfs/git-lfs/commit/032dca8ee69c193208cd050024c27e82e11aef81

Submissão

Modificações