名称: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
基本信息
引入方式
Implementation适用平台
编程语言
类： Not Language-Specific (Undetermined)操作系统
名称： Windows NT (Sometimes)名称： macOS (Rarely)
常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands 注意： If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec. |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2005-1185 | Small handful of others. Program doesn't quote the "C:\Program Files\" path when calling a program to be executed - or any other path with a directory or file whose name contains a space - so attacker can put a malicious program.exe into C:. |
CVE-2005-2938 | CreateProcess() and CreateProcessAsUser() can be misused by applications to allow "program.exe" style attacks in C: |
CVE-2000-1128 | Applies to "Common Files" folder, with a malicious common.exe, instead of "Program Files"/program.exe. |
潜在缓解措施
Phases : ImplementationProperly quote the full search path before executing a program on the system.
Phases : Implementation
Phases : Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
漏洞映射说明
依据 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
备注
参考资料
REF-62
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh.
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Description, Maintenance_Notes, Other_Notes, Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Other_Notes | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Research_Gaps | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
