Fallos del tipo CWE-61

192 resultados

Seguimento de ligações simbólicas em UNIX

Fraqueza onde uma aplicação segue uma ligação simbólica (symlink) sem validar adequadamente, permitindo que um atacante redirecione operações de arquivo para locais não intencionais. Um processo com privilégios elevados pode acabar lendo, escrevendo ou deletando arquivos críticos do sistema ao seguir um symlink malicioso criado pelo atacante.

Ejemplo

Um script de limpeza executado como root tenta remover arquivos em /tmp/cache sem verificar se são symlinks. Um atacante cria um symlink em /tmp/cache apontando para /etc/passwd, e o script acaba deletando a credencial do sistema. Ou um programa tenta criar um arquivo de log em /tmp sem checar se /tmp/app.log já é um symlink para /etc/shadow.

Cómo mitigar

Use funções seguras como open() com flags O_NOFOLLOW, lstat() em vez de stat(), ou valide o caminho com realpath() antes de operar. Em shell scripts, use [[ -L file ]] para detectar symlinks. Mantenha /tmp e /var/tmp com sticky bit (1777) e evite TOCTOU—verifique e acesse atomicamente ou use descritores de arquivo.

CVE-2023-20091MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2023-20092MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2026-39860CRITICALNix sandbox escape: file write via symlink at FOD `.tmp` copy destinationEPSS 0.2%CVE-2024-39578MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileEPSS 0.2%CVE-2024-47480HIGHDell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privEPSS 0.2%CVE-2026-12958HIGHArbitrary file write in Language Servers for AWSEPSS 0.2%CVE-2024-25953MEDIUMDell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privilEPSS 0.2%CVE-2024-25952MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privilEPSS 0.2%CVE-2026-41579LOWrunc: Malicious image with /dev symlink can trigger limited host filesystem integrity violationsEPSS 0.2%CVE-2026-13748MEDIUMSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path RestrictionEPSS 0.2%CVE-2026-34446MEDIUMONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX loadEPSS 0.2%CVE-2025-54867HIGHYouki Symlink Following VulnerabilityEPSS 0.2%CVE-2025-22480HIGHDell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with localEPSS 0.2%CVE-2026-90616HIGHIn Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated EPSS 0.2%CVE-2024-52542MEDIUMDell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could EPSS 0.2%CVE-2026-14699MEDIUMzcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlinkEPSS 0.2%CVE-2026-53489HIGHcontainerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreEPSS 0.2%CVE-2024-52537MEDIUMDell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local accesEPSS 0.2%CVE-2026-65010MEDIUMDatasets Symlink-following Arbitrary File Write via Extractor.extract()EPSS 0.2%CVE-2026-56815HIGHpwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/HomEPSS 0.2%