名稱: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
一般資訊
引入方式
Implementation適用平台
程式語言
類別： Not Language-Specific (Undetermined)作業系統
名稱： Windows NT (Sometimes)名稱： macOS (Rarely)
常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands 注意：If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2005-1185 | Small handful of others. Program doesn't quote the "C:\Program Files\" path when calling a program to be executed - or any other path with a directory or file whose name contains a space - so attacker can put a malicious program.exe into C:. |
CVE-2005-2938 | CreateProcess() and CreateProcessAsUser() can be misused by applications to allow "program.exe" style attacks in C: |
CVE-2000-1128 | Applies to "Common Files" folder, with a malicious common.exe, instead of "Program Files"/program.exe. |
潛在緩解措施
Phases : ImplementationProperly quote the full search path before executing a program on the system.
Phases : Implementation
Phases : Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
備注
參考資料
REF-62
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh.
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Description, Maintenance_Notes, Other_Notes, Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Other_Notes | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Research_Gaps | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
