127
Description
The product constructs pathnames from user input, but it does not handle or incorrectly handles a
pathname containing a Windows device name such as AUX or CON. This typically leads to denial
of service or an information exposure when the application attempts to process the pathname as a
regular file.
Extended Description
Not properly handling virtual filenames (e.g. AUX, CON, PRN, COM1, LPT1) can result in different
types of vulnerabilities. In some cases an attacker can request a device via injection of a virtual
filename in a URL, which may cause an error that leads to a denial of service or an error page that
reveals sensitive information. A product that allows device names to bypass filtering runs the risk of
an attacker injecting malicious code in a file with the name of a device.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 66 Improper Handling of File Names that Identify Virtual
Resources