Falhas do tipo CWE-59

961 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2019-1130HIGHAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElEPSS 1.7%KEVCVE-2024-30076MEDIUMWindows Container Manager Service Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2017-12258—A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a croEPSS 1.7%CVE-2026-34078CRITICALFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextEPSS 1.7%CVE-2024-12390HIGHRemote Code Execution in binary-husky/gpt_academicEPSS 1.7%CVE-2023-36903HIGHWindows System Assessment Tool Elevation of Privilege VulnerabilityEPSS 1.6%CVE-2021-44052MEDIUMArbitrary file readEPSS 1.6%CVE-2024-6868HIGHArbitrary File Write in mudler/LocalAIEPSS 1.5%CVE-2025-24104MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4. Restoring a malEPSS 1.5%CVE-2024-30104HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-50404MEDIUMQsync CentralEPSS 1.4%CVE-2024-21447HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 1.4%CVE-2026-69414HIGHMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 1.4%CVE-2021-1491MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 1.3%CVE-2025-48799HIGHWindows Update Service Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2023-36758HIGHVisual Studio Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2024-38081HIGH.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2025-30457CRITICALThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturaEPSS 1.2%CVE-2023-32056HIGHWindows Server Update Service (WSUS) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2019-8463—A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service lEPSS 1.2%