Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2021-32548HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32555HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2025-24242MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app with root privileges may be aEPSS 0.3%CVE-2021-32549HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32552HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32550HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-48921HIGHJenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aEPSS 0.3%CVE-2021-32554HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-90807MEDIUMnanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link followingEPSS 0.3%CVE-2019-13689HIGHInappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/wrEPSS 0.3%CVE-2026-53476CRITICALAssisted-migration-agent: vddk tarball chained-symlink arbitrary file writeEPSS 0.3%CVE-2024-45770MEDIUMPcp: pmpost symlink attack allows escalating pcp to root userEPSS 0.3%CVE-2022-21944HIGHwatchman: chown in watchman@.socket unit allows symlink attackEPSS 0.3%CVE-2026-53801HIGHrsync < 3.5.0 Symlink Race Condition Directory TraversalEPSS 0.3%CVE-2026-65680MEDIUMMicrosoft OneDrive for MacOS Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-40610MEDIUMBentoML has Information Disclosure in `bentoml build` via symlink traversal in the build contextEPSS 0.3%CVE-2023-24577MEDIUMMcAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. ThisEPSS 0.3%CVE-2024-13043HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-24136MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VenturaEPSS 0.3%CVE-2025-65843HIGHAquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. The applEPSS 0.3%