2263
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Terminology
Symbolic links, hard links, junctions, and mount points can be confusing terminology, as there
are differences in how they operate between UNIX-based systems and Windows, and there are
interactions between them.
Maintenance
This entry is still under development and will continue to see updates and content improvements.
References
[REF-1262]Eran Shimony. "Follow the Link: Exploiting Symbolic Links with Ease". 2019 October
3. < https://www.cyberark.com/resources/threat-research-blog/follow-the-link-exploiting-symboliclinks-
with-ease >.
[REF-1264]James Forshaw. "Windows 10^H^H Symbolic Link Mitigations". 2015 August 5. <
https://googleprojectzero.blogspot.com/2015/08/windows-10hh-symbolic-link-mitigations.html >.
[REF-1265]"Symbolic testing tools". < https://github.com/googleprojectzero/symboliclink-testingtools
>.
[REF-1266]Shubham Dubey. "Understanding and Exploiting Symbolic links in Windows - Symlink
Attack EOP". 2020 April 6. < https://nixhacker.com/understanding-and-exploiting-symbolic-link-inwindows/
>.
[REF-1267]Simon Zuckerbraun. "Abusing Arbitrary File Deletes to Escalate Privilege and Other
Great Tricks". 2022 March 7. < https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitraryfile-
deletes-to-escalate-privilege-and-other-great-tricks >.
[REF-1271]Clément Lavoillotte. "Abusing privileged file operations". 2019 March 0. < https://
troopers.de/troopers19/agenda/7af9hw/ >.
CWE-1389: Incorrect Parsing of Numbers with Different Radices
Weakness ID : 1389
Structure : Simple
Abstraction : Base
Description
The product parses numeric input assuming base 10 (decimal) values, but it does not account for
inputs that use a different base number (radix).
Extended Description
Frequently, a numeric input that begins with "0" is treated as octal, or "0x" causes it to be treated as
hexadecimal, e.g. by the inet_addr() function. For example, "023" (octal) is 35 decimal, or "0x31" is
49 decimal. Other bases may be used as well. If the developer assumes decimal-only inputs, the
code could produce incorrect numbers when the inputs are parsed using a different base. This can
result in unexpected and/or dangerous behavior. For example, a "0127.0.0.1" IP address is parsed
as octal due to the leading "0", whose numeric value would be the same as 87.0.0.1 (decimal),
where the developer likely expected to use 127.0.0.1.
The consequences vary depending on the surrounding code in which this weakness occurs, but
they can include bypassing network-based access control using unexpected IP addresses or
CWE Version 4.14
CWE-1389: Incorrect Parsing of Numbers with Different Radices
CWE-1389: Incorrect Parsing of Numbers with Different Radices