Falhas do tipo CWE-61

194 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2025-36564HIGHDell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could poEPSS 0.1%CVE-2025-43991MEDIUMSupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic LiEPSS 0.1%CVE-2026-7832HIGHIObit Advanced SystemCare Service ASC.exe symlinkEPSS 0.1%CVE-2026-21916HIGHJunos OS: A low privileged user can escalate their privileges so that they can login as rootEPSS 0.1%CVE-2026-40354LOWFlatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlinkEPSS 0.1%CVE-2026-105712LOWgpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directoryEPSS 0.1%CVE-2026-91202MEDIUMCockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged pasteEPSS 0.1%CVE-2026-96807MEDIUMIn Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to writEPSS 0.1%CVE-2026-96808HIGHIn Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validEPSS 0.1%CVE-2026-64846LOWNix: Arbitrary file truncation outside the sandbox with recursive-nix experimental featureEPSS 0.1%CVE-2026-42306HIGHMoby: Race condition in docker cp allows bind mount redirection to host pathEPSS 0.1%CVE-2026-102740MEDIUMAsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlinkEPSS 0.1%CVE-2026-65109MEDIUMNVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of EPSS —CVE-2026-121520MEDIUMMalicious client could set xattr value outside of BuildKit state directoryEPSS —