Falhas do tipo CWE-59

820 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2019-1129HIGHAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElEPSS 1.8%KEVCVE-2023-29343HIGHSysInternals Sysmon for Windows Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2024-30076MEDIUMWindows Container Manager Service Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2017-12258—A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a croEPSS 1.7%CVE-2026-34078CRITICALFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextEPSS 1.7%CVE-2024-12390HIGHRemote Code Execution in binary-husky/gpt_academicEPSS 1.6%CVE-2023-36903HIGHWindows System Assessment Tool Elevation of Privilege VulnerabilityEPSS 1.6%CVE-2021-44052MEDIUMArbitrary file readEPSS 1.6%CVE-2024-6868HIGHArbitrary File Write in mudler/LocalAIEPSS 1.5%CVE-2024-30104HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-24104MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4. Restoring a malEPSS 1.5%CVE-2024-50404MEDIUMQsync CentralEPSS 1.4%CVE-2024-21447HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 1.4%CVE-2021-1491MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 1.3%CVE-2023-36758HIGHVisual Studio Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2024-38081HIGH.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2023-32056HIGHWindows Server Update Service (WSUS) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2026-63294CRITICALRoot RCE via image backup.yaml symlinkEPSS 1.2%CVE-2019-8463—A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service lEPSS 1.2%CVE-2020-26277MEDIUMArbitrary read/write in DBdeployerEPSS 1.2%