CWE-224: Obscured Security-relevant Information by Alternate Name
Obscured Security-relevant Information by Alternate Name
Weakness ID: 224 (Weakness Base)
Status: Incomplete
Description
Description Summary
The software records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
Time of Introduction
Architecture and Design
Implementation
Operation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Non-Repudiation
Access Control
Technical Impact: Hide activities; Gain privileges / assume
identity
Demonstrative Examples
Example 1
This code prints the contents of a file if a user has permission.
(Bad Code)
Example
Language: PHP
function readFile($filename){
$user = getCurrentUser();
$realFile = $filename;
//resolve file if its a symbolic link
if(is_link($filename)){
$realFile = readlink($filename);
}
if(fileowner($realFile) == $user){
echo file_get_contents($realFile);
return;
}
else{
echo 'Access denied';
writeLog($user . ' attempted to access the file '.
$filename . ' on '. date('r'));
}
}
While the code logs a bad access attempt, it logs the user supplied name for the file, not the canonicalized file name. An attacker can obscure his target by giving the script the name of a link to the file he is attempting to access. Also note this code contains a race condition between the is_link() and readlink() functions (CWE-363).
Description
