Fallos del tipo CWE-61

173 resultados

Seguimento de ligações simbólicas em UNIX

Fraqueza onde uma aplicação segue uma ligação simbólica (symlink) sem validar adequadamente, permitindo que um atacante redirecione operações de arquivo para locais não intencionais. Um processo com privilégios elevados pode acabar lendo, escrevendo ou deletando arquivos críticos do sistema ao seguir um symlink malicioso criado pelo atacante.

Ejemplo

Um script de limpeza executado como root tenta remover arquivos em /tmp/cache sem verificar se são symlinks. Um atacante cria um symlink em /tmp/cache apontando para /etc/passwd, e o script acaba deletando a credencial do sistema. Ou um programa tenta criar um arquivo de log em /tmp sem checar se /tmp/app.log já é um symlink para /etc/shadow.

Cómo mitigar

Use funções seguras como open() com flags O_NOFOLLOW, lstat() em vez de stat(), ou valide o caminho com realpath() antes de operar. Em shell scripts, use [[ -L file ]] para detectar symlinks. Mantenha /tmp e /var/tmp com sticky bit (1777) e evite TOCTOU—verifique e acesse atomicamente ou use descritores de arquivo.

CVE-2024-52537MEDIUMDell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local accesEPSS 0.2%CVE-2026-14699MEDIUMzcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlinkEPSS 0.2%CVE-2026-53489HIGHcontainerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreEPSS 0.2%CVE-2024-52542MEDIUMDell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could EPSS 0.2%CVE-2026-56815HIGHpwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/HomEPSS 0.2%CVE-2026-65010MEDIUMDatasets Symlink-following Arbitrary File Write via Extractor.extract()EPSS 0.2%CVE-2026-59674HIGHLPE from suricata user to root due to chown in %post in suricata packagingEPSS 0.2%CVE-2025-53881MEDIUMSUSE-specific logrotate configuration allows escalation from mail user/group to rootEPSS 0.2%CVE-2026-90616HIGHIn Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated EPSS 0.2%CVE-2025-46810HIGHA UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate EPSS 0.2%CVE-2026-22767HIGHDell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local accEPSS 0.2%CVE-2026-77159MEDIUMLibvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlinkEPSS 0.2%CVE-2026-47766MEDIUMcrun follows rootfs /dev symlink while creating default devicesEPSS 0.2%CVE-2025-64750MEDIUMSingluarity ineffectively applies of selinux / apparmor LSM process labelsEPSS 0.2%CVE-2026-8784MEDIUMnpitre cramfs-tools cramfsck.c change_file_status symlinkEPSS 0.2%CVE-2025-1079HIGHRCE In Google Web DesignerEPSS 0.2%CVE-2023-39246MEDIUM Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure OEPSS 0.2%CVE-2025-43278MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protectEPSS 0.2%CVE-2026-54574HIGH`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar ArchiveEPSS 0.1%CVE-2026-13218MEDIUMKubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherEPSS 0.1%