Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2024-1867HIGHG DATA Total Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-1868HIGHG DATA Total Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-27347HIGHG DATA Total Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-53795HIGHrsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-destEPSS 0.4%CVE-2024-6233HIGHCheck Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-42126HIGHG DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-32050HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-53793CRITICALrsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot ModeEPSS 0.4%CVE-2017-7501—It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with abilitEPSS 0.4%CVE-2020-7250HIGHENS symbolic link log file manipulation vulnerabilityEPSS 0.4%CVE-2023-25145HIGHA link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges onEPSS 0.4%CVE-2020-7319HIGHImproper Access Control Vulnerability in ENS for WindowsEPSS 0.4%CVE-2021-32557MEDIUMapport process_report() arbitrary file writeEPSS 0.4%CVE-2023-25148HIGHA security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing EPSS 0.4%CVE-2023-25146HIGHA security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete thEPSS 0.4%CVE-2024-6147HIGHPoly Plantronics Hub Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-45491MEDIUM.NET Tampering VulnerabilityEPSS 0.4%CVE-2025-27850HIGHThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlEPSS 0.4%CVE-2026-82252HIGHgitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesEPSS 0.4%CVE-2021-23177—An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. AEPSS 0.4%