Falhas do tipo CWE-428

358 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2021-47886HIGHPingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service PathEPSS 0.2%CVE-2026-57223HIGHSuricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalationEPSS 0.2%CVE-2021-47883HIGHSandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service PathEPSS 0.2%CVE-2020-36958HIGHKite 1.2020.1119.0 - 'KiteService' Unquoted Service PathEPSS 0.2%CVE-2019-25302HIGHAcer Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service PathEPSS 0.2%CVE-2020-36959HIGHIDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service PathEPSS 0.2%CVE-2020-36980HIGHSAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service PathEPSS 0.2%CVE-2021-47880HIGHRealtek Wireless LAN Utility 700.1631 - 'Realtek11nSU' Unquoted Service PathEPSS 0.2%CVE-2021-47861HIGHEvent Log Explorer 4.9.3 - 'ElodeaEventCollectorService' Unquoted Service PathEPSS 0.2%CVE-2021-47864HIGHOSAS Traverse Extension 11 - 'travextensionhostsvc' Unquoted Service PathEPSS 0.2%CVE-2020-36957HIGHPDF Complete 3.5.310.2002 - 'pdfsvc.exe' Unquoted Service PathEPSS 0.2%CVE-2021-47884HIGHConfiguration Tool 1.6.53 - 'OpLclSrv' Unquoted Service PathEPSS 0.2%CVE-2021-47867HIGHWIN-PACK PRO 4.8 - 'ScheduleService' Unquoted Service PathEPSS 0.2%CVE-2021-47887HIGHPrint Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service PathEPSS 0.2%CVE-2021-47878HIGHeBeam Education Suite 2.5.0.9 - 'eBeam Device Service' Unquoted Service PathEPSS 0.2%CVE-2021-47874HIGHVFS for Git 1.0.21014.1 - 'GVFS.Service' Unquoted Service PathEPSS 0.2%CVE-2019-25305HIGHJumpStart 0.6.0.0 - 'jswpbapi' Unquoted Service PathEPSS 0.2%CVE-2021-47859HIGHActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service PathEPSS 0.2%CVE-2019-25345HIGHRTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service PathEPSS 0.2%CVE-2021-47863HIGHMacPaw Encrypto 1.0.1 - 'Encrypto Service' Unquoted Service PathEPSS 0.2%