CWE-59: Improper Link Resolution Before File Access ('Link Following')
Individual Definition in a New Window
Improper Link Resolution Before File Access ('Link Following')
Status: Draft
Weakness ID: 59 (Weakness Base)
Description
Summary
The software attempts to access a file based on the filename,
but it does not properly prevent that filename from identifying a link or
shortcut that resolves to an unintended resource.
Alternate Terms
insecure temporary file
Some people use the phrase "insecure temporary file" when referring to
a link following weakness, but other weaknesses can produce insecure
temporary files without any symlink involvement at all.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Operating Systems
Windows (Sometimes)
UNIX (Often)
Likelihood of Exploit
Low to Medium
Potential Mitigations
Follow the principle of least privilege when assigning access rights
to files. Denying access to a file can prevent an attacker from
replacing that file with a link to a sensitive file. Ensure good
compartmentalization in the system to provide protected areas that can
be trusted.
Other Notes
Windows soft links can be exploited remotely since a ".LNK" file can be
uploaded like a normal file.
Weakness Ordinalities
Resultant(where the weakness
is typically related to the presence of some other
weaknesses)
Link following vulnerabilities are Multi-factor Vulnerabilities (MFV).
They are the combination of multiple elements: file or directory
permissions, filename predictability, race conditions, and in some cases, a
design limitation in which there is no mechanism for performing atomic file
creation operations.
Some potential factors are race conditions, permissions, and
predictability.
Research Gaps
UNIX hard links, and Windows hard/soft links are under-studied and
under-reported.
Affected Resources
File/Directory
Functional Areas
File processing, temporary files
Causal Nature
Explicit(an explicit
weakness resulting from behavior of the
developer)
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Mapped Node Name
PLOVER
Link Following
CERT C Secure Coding
FIO02-C
Canonicalize path names originating from untrusted
sources
CERT C Secure Coding
POS01-C
Check for the existence of links when dealing with
files
Description
Implementation
