Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2025-65843HIGHAquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. The applEPSS 0.3%CVE-2026-19693HIGHextract-zip arbitrary file write outside the destination directory via a symlink at the final path componentEPSS 0.3%CVE-2026-68830MEDIUMWindows Universal Plug and Play (UPnP) Device Host Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-44273MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS SonoEPSS 0.3%CVE-2024-12753MEDIUMFoxit PDF Reader Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2009-1142MEDIUMAn issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-useEPSS 0.3%CVE-2022-0017HIGHGlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege EscalationEPSS 0.3%CVE-2023-21542HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-15788MEDIUMWCOW cache mount source selector resolves NTFS junctions outside of cache rootEPSS 0.3%CVE-2026-62776HIGHWindows DHCP Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-11853MEDIUMDebusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload aEPSS 0.3%CVE-2026-54056HIGHKitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop stagingEPSS 0.3%CVE-2024-27885MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS VenturEPSS 0.3%CVE-2024-7236MEDIUMAVG AntiVirus Free icarus Arbitrary File Creation Denial of Service VulnerabilityEPSS 0.3%CVE-2026-69425MEDIUMWindows NTFS Tampering VulnerabilityEPSS 0.3%CVE-2025-22247MEDIUMInsecure file handling vulnerabilityEPSS 0.3%CVE-2026-69379HIGHWindows NTFS Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2021-27241MEDIUMThis vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (BuiEPSS 0.3%CVE-2024-45316HIGHThe Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlierEPSS 0.3%CVE-2023-1314HIGHLocal Privilege Escalation Vulnerability in cloudflared's InstallerEPSS 0.3%