Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2023-32182MEDIUMA Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUEPSS 0.3%CVE-2026-39243MEDIUMdecompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. WheEPSS 0.3%CVE-2026-54706MEDIUMOnionShare follows symlinks in shared directories, allowing unintended disclosure of local filesEPSS 0.3%CVE-2025-34191HIGHVasion Print (formerly PrinterLogic) Arbitrary File Write as Root via Response Path Symlink FollowEPSS 0.3%CVE-2021-32547HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2025-69430MEDIUMAn Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12), EPSS 0.3%CVE-2025-69431MEDIUMThe ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create aEPSS 0.3%CVE-2025-69429MEDIUMThe ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploited by attackers to EPSS 0.3%CVE-2022-4563HIGHFreedom of the Press SecureDrop gpg-agent.conf symlinkEPSS 0.3%CVE-2022-2897HIGHMeasuresoft ScadaPro Server and Client Link FollowingEPSS 0.3%CVE-2025-43448MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1EPSS 0.3%CVE-2022-32905HIGHThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMGEPSS 0.3%CVE-2022-2145MEDIUMCloudlfare WARP Arbitrary File OverwriteEPSS 0.3%CVE-2024-6260HIGHMalwarebytes Antimalware Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-18267MEDIUMKenwood DNR1007XR Firmware Update Link Following Code Execution VulnerabilityEPSS 0.3%CVE-2026-62812HIGHWindows DHCP Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-38730MEDIUMDocker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by contEPSS 0.3%CVE-2026-47699MEDIUMConfidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallbackEPSS 0.3%CVE-2021-32552HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32549HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%