CWE-59Improper Link Resolution Before File Access ('Link Following')

Description

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Common consequences

• Confidentiality,Integrity,Access Control→Read Files or Directories,Modify Files or Directories,Bypass Protection Mechanism
  An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
• Other→Execute Unauthorized Code or Commands
  Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.

Potential mitigations

• Architecture and Design
  [object Object]

Related CWEs

Recent CVEs classified under this CWE