1367
in general, it appears like any other file in the file system. However, the link includes a reference
to another file, often in another directory - perhaps in another sphere of control. Many common
library functions that accept filenames will "follow" a symbolic link and use the link's target
instead.
Maintenance
The relationship between CWE-99 and CWE-610 needs further investigation and clarification.
They might be duplicates. CWE-99 "Resource Injection," as originally defined in Seven
Pernicious Kingdoms taxonomy, emphasizes the "identifier used to access a system resource"
such as a file name or port number, yet it explicitly states that the "resource injection" term does
not apply to "path manipulation," which effectively identifies the path at which a resource can
be found and could be considered to be one aspect of a resource identifier. Also, CWE-610
effectively covers any type of resource, whether that resource is at the system layer, the
application layer, or the code layer.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
219 XML Routing Detour Attacks
CWE-611: Improper Restriction of XML External Entity Reference
Weakness ID : 611
Structure : Simple
Abstraction : Base
Description
The product processes an XML document that can contain XML entities with URIs that resolve
to documents outside of the intended sphere of control, causing the product to embed incorrect
documents into its output.
Extended Description
XML documents optionally contain a Document Type Definition (DTD), which, among other
features, enables the definition of XML entities. It is possible to define an entity by providing a
substitution string in the form of a URI. The XML parser can access the contents of this URI and
embed these contents back into the XML document for further processing.
By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause
the processing application to read the contents of a local file. For example, a URI such as "file:///c:/
winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the
password file in Unix-based systems. Using URIs with other schemes such as http://, the attacker
can force the application to make outgoing requests to servers that the attacker cannot reach
directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port
scanning.
Once the content of the URI is read, it is fed back into the application that is processing the XML.
This application may echo back the data (e.g. in an error message), thereby exposing the file
contents.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-611: Improper Restriction of XML External Entity Reference
CWE-611: Improper Restriction of XML External Entity Reference