Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2024-30033HIGHWindows Search Service Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2024-48862HIGHQuLog CenterEPSS 0.9%CVE-2023-21722MEDIUM.NET Framework Denial of Service VulnerabilityEPSS 0.9%CVE-2024-3829CRITICALArbitrary File Read and Write during Snapshot Recovery in qdrant/qdrantEPSS 0.9%CVE-2023-7216MEDIUMCpio: extraction allows symlinks which enables remote command executionEPSS 0.9%CVE-2023-33865HIGHRenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownersEPSS 0.9%CVE-2024-36305HIGHA security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalEPSS 0.9%CVE-2024-30018HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-35624HIGHAzure Connected Machine Agent Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-33245HIGHMinecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world EPSS 0.9%CVE-2024-26216HIGHWindows File Server Resource Management Service Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-15815HIGHCVE-2026-15815 CVE RecordEPSS 0.9%CVE-2025-43220CRITICALThis issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7EPSS 0.9%CVE-2024-43470HIGHAzure Network Watcher VM Agent Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-70563HIGHWindows Shell Spoofing VulnerabilityEPSS 0.8%CVE-2024-10007HIGHPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationEPSS 0.8%CVE-2026-53535MEDIUMActivepieces: Arbitrary file write in git-sync via path traversal and symlinksEPSS 0.8%CVE-2024-30065MEDIUMWindows Themes Denial of Service VulnerabilityEPSS 0.8%CVE-2025-23267HIGHNVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link followiEPSS 0.8%CVE-2022-4122MEDIUMA vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in informatioEPSS 0.8%