|
|
|
|
CWE-41 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Incomplete 41 (Weakness Class) | | Description | Summary The system or application is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object. Path equivalence is usually employed in order to circumvent access controls expressed using an incomplete set of file name or file path representations. This is different from path traversal, wherein the manipulations are performed to generate a name for a different object. | | Affected Resource | File/Directory | | Potential Mitigations | Assume all input is malicious. Attackers can insert special characters into resources
(e.g. filenames) to disguise their input. Use an appropriate combination of black lists and
white lists to ensure only valid and expected input is processed by the system. Warning: if
you attempt to cleanse your data, then do so that the end result is not in the form that can
be dangerous. A sanitizing mechanism can remove characters such as ‘.' and ‘;' which may be
required for some exploits. An attacker can try to fool the sanitizing mechanism into
"cleaning" data into a dangerous form. Suppose the attacker injects a ‘.' inside a filename
(e.g. "sensi.tiveFile") and the sanitizing mechanism removes the character resulting in the
valid filename, "sensitiveFile". If the input data are now assumed to be safe, then the file
may be compromised. | | Context Notes | Some of these manipulations could be effective in path traversal issues, too. | | Relationships | | | Source Taxonomies | PLOVER - Path Equivalence | | Applicable Platforms | All | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 3 | Using Leading 'Ghost' Character Sequences to Bypass Input Filters | | 4 | Using Alternative IP Address Encodings |
|
|