CWE-59: Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following')
Weakness ID: 59 (Weakness Base)
Status: Draft
Description
Description Summary
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Alternate Terms
insecure temporary file:
Some people use the phrase "insecure temporary file" when referring to
a link following weakness, but other weaknesses can produce insecure
temporary files without any symlink involvement at all.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Operating Systems
Windows: (Sometimes)
UNIX: (Often)
Common Consequences
Scope
Effect
Confidentiality
Integrity
Access Control
Technical Impact: Read files or
directories; Modify files or
directories; Bypass protection
mechanism
An attacker may be able to traverse the file system to unintended
locations and read or overwrite the contents of unexpected files. If the
files are used for a security mechanism than an attacker may be able to
bypass the mechanism.
Some versions of Perl follows symbolic links when
running with the -e option, which allows local users to overwrite arbitrary
files via a symlink attack.
Text editor follows symbolic links when creating
a rescue copy during an abnormal exit, which allows local users to overwrite
the files of other users.
Window manager does not properly handle when
certain symbolic links point to "stale" locations, which could allow local
users to create or truncate arbitrary files.
Setuid product allows file reading by replacing a
file being edited with a symlink to the targeted file, leaking the result in
error messages when parsing fails.
Mail client allows remote attackers to bypass the
user warning for executable attachments such as .exe, .com, and .bat by
using a .lnk file that refers to the attachment, aka "Stealth Attachment."
Browser allows remote malicious web sites to
overwrite arbitrary files by tricking the user into downloading a .LNK
(link) file twice, which overwrites the file that was referenced in the
first .LNK file.
File system allows local attackers to hide file
usage activities via a hard link to the target file, which causes the link
to be recorded in the audit trail instead of the target file.
Web server plugin allows local users to overwrite
arbitrary files via a symlink attack on predictable temporary filenames.
Potential Mitigations
Phase: Architecture and Design
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights
to entities in a software system.
Denying access to a file can prevent an attacker from replacing that
file with a link to a sensitive file. Ensure good compartmentalization
in the system to provide protected areas that can be trusted.
Background Details
Soft links are a UNIX term that is synonymous with simple shortcuts on
windows based platforms.
Other Notes
Windows simple shortcuts, sometimes referred to as soft links, can be
exploited remotely since an ".LNK" file can be uploaded like a normal
file.
Weakness Ordinalities
Ordinality
Description
Resultant
(where
the weakness is typically related to the presence of some other
weaknesses)
Link following vulnerabilities are Multi-factor Vulnerabilities (MFV).
They are the combination of multiple elements: file or directory
permissions, filename predictability, race conditions, and in some cases, a
design limitation in which there is no mechanism for performing atomic file
creation operations.
Some potential factors are race conditions, permissions, and
predictability.
Research Gaps
UNIX hard links, and Windows hard/soft links are under-studied and
under-reported.
Affected Resources
File/Directory
Functional Areas
File processing, temporary files
Causal Nature
Explicit
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
PLOVER
Link Following
CERT C Secure Coding
FIO02-C
Canonicalize path names originating from untrusted
sources
CERT C Secure Coding
POS01-C
Check for the existence of links when dealing with
files
CERT C++ Secure Coding
FIO02-CPP
Canonicalize path names originating from untrusted
sources
[REF-7] Mark Dowd, John McDonald
and Justin Schuh. "The Art of Software Security Assessment". Chapter 9, "Symbolic Link Attacks", Page
518.. 1st Edition. Addison Wesley. 2006.
Description
