Falhas do tipo CWE-61

173 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2024-45310LOWrunc can be confused to create empty files/directories on the hostEPSS 0.3%CVE-2026-57825MEDIUMIn the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .EPSS 0.3%CVE-2023-41969HIGHZSATrayManager Arbitrary File DeletionEPSS 0.3%CVE-2025-33225HIGHNVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an attacker could cause predictable log-file names.EPSS 0.3%CVE-2021-32547HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-5223MEDIUMCrates in third party registries can override the cached source of other cratesEPSS 0.3%CVE-2021-32548HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32549HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32552HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32554HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32555HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2020-15075—OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmpEPSS 0.3%CVE-2021-32550HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32551HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2025-43853HIGHiwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi featureEPSS 0.3%CVE-2026-23986MEDIUMCopier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: trueEPSS 0.3%CVE-2026-28684MEDIUMpython-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallbackEPSS 0.3%CVE-2025-66431HIGHWebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root viaEPSS 0.3%CVE-2024-27872MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protecEPSS 0.3%CVE-2021-1612MEDIUMCisco IOS XE SD-WAN Software Arbitrary File Overwrite VulnerabilityEPSS 0.3%