590
Scope Impact Likelihood
Confidentiality Read Files or Directories
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
Consider the following source code from a (hypothetical) FTP server:
Example Language: C (Bad)
chroot("/var/ftproot");
...
fgets(filename, sizeof(filename), network);
localfile = fopen(filename, "r");
while ((len = fread(buf, 1, sizeof(buf), localfile)) != EOF) {
fwrite(buf, 1, sizeof(buf), network);
}
fclose(localfile);
This code is responsible for reading a filename from the network, opening the corresponding file
on the local machine, and sending the contents over the network. This code could be used to
implement the FTP GET command. The FTP server calls chroot() in its initialization routines in an
attempt to prevent access to files outside of /var/ftproot. But because the server does not change
the current working directory by calling chdir("/"), an attacker could request the file "../../../../../etc/
passwd" and obtain a copy of the system password file.
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 979 SFP Secondary Cluster: Failed Chroot Jail 888 2408
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Directory Restriction
Software Fault Patterns SFP17 Failed chroot jail
References
CWE Version 4.14
CWE-244: Improper Clearing of Heap Memory Before Release ('Heap Inspection')
CWE-244: Improper Clearing of Heap Memory Before Release ('Heap Inspection')