1041
Example Language: C (Bad)
UINT errCode = WinExec( "C:\\Program Files\\Foo\\Bar", SW_SHOW );
Observed Examples
Reference Description
CVE-2005-1185 Small handful of others. Program doesn't quote the "C:\Program Files\" path
when calling a program to be executed - or any other path with a directory
or file whose name contains a space - so attacker can put a malicious
program.exe into C:.
https://www.cve.org/CVERecord?id=CVE-2005-1185
CVE-2005-2938 CreateProcess() and CreateProcessAsUser() can be misused by applications
to allow "program.exe" style attacks in C:
https://www.cve.org/CVERecord?id=CVE-2005-2938
CVE-2000-1128 Applies to "Common Files" folder, with a malicious common.exe, instead of
"Program Files"/program.exe.
https://www.cve.org/CVERecord?id=CVE-2000-1128
Functional Areas
• Program Invocation
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Applicable Platform
This weakness could apply to any OS that supports spaces in filenames, especially any OS
that make it easy for a user to insert spaces into filenames or folders, such as Windows. While
spaces are technically supported in Unix, the practice is generally avoided. .
Maintenance
This weakness primarily involves the lack of quoting, which is not explicitly stated as a part of
CWE-116. CWE-116 also describes output in light of structured messages, but the generation of
a filename or search path (as in this weakness) might not be considered a structured message.
An additional complication is the relationship to control spheres. Unlike untrusted search path
(CWE-426), which inherently involves control over the definition of a control sphere, this entry
concerns a fixed control sphere in which some part of the sphere may be under attacker control.
This is not a clean fit under CWE-668 or CWE-610, which suggests that the control sphere model
needs enhancement or clarification.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unquoted Search Path or Element
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE Version 4.14
CWE-430: Deployment of Wrong Handler
CWE-430: Deployment of Wrong Handler