119
Symlink vulnerabilities are regularly found in C and shell programs, but all programming
languages can have this problem. Even shell programs are probably under-reported. "Secondorder
symlink vulnerabilities" may exist in programs that invoke other programs that follow
symlinks. They are rarely reported but are likely to be fairly common when process invocation is
used [REF-493].
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER UNIX symbolic link following
Related Attack Patterns
CAPEC-ID Attack Pattern Name
27 Leveraging Race Conditions via Symbolic Links
References
[REF-493]Steve Christey. "Second-Order Symlink Vulnerabilities". Bugtraq. 2005 June 7. < https://
seclists.org/bugtraq/2005/Jun/44 >.2023-04-07.
[REF-494]Shaun Colley. "Crafting Symlinks for Fun and Profit". Infosec Writers Text Library. 2004
April 2. < http://www.infosecwriters.com/texts.php?op=display&id=159 >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-62: UNIX Hard Link
Weakness ID : 62
Structure : Simple
Abstraction : Variant
Description
The product, when opening a file or directory, does not sufficiently account for when the name is
associated with a hard link to a target that is outside of the intended control sphere. This could
allow an attacker to cause the product to operate on unauthorized files.
Extended Description
Failure for a system to check for hard links can result in vulnerability to different types of attacks.
For example, an attacker can escalate their privileges if a file used by a privileged program is
replaced with a hard link to a sensitive file (e.g. /etc/passwd). When the process opens the file, the
attacker can assume the privileges of that process.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 59 Improper Link Resolution Before File Access ('Link
Following')