136
The following code uses input from a configuration file to determine which file to open and
echo back to the user. If the program runs with privileges and malicious users can change the
configuration file, they can use the program to read any file on the system that ends with the
extension .txt.
Example Language: Java (Bad)
fis = new FileInputStream(cfg.getProperty("sub")+".txt");
amt = fis.read(arr);
out.println(arr);
Observed Examples
Reference Description
CVE-2022-45918 Chain: a learning management tool debugger uses external input to locate
previous session logs (CWE-73) and does not properly validate the given
path (CWE-20), allowing for filesystem path traversal using "../" sequences
(CWE-24)
https://www.cve.org/CVERecord?id=CVE-2022-45918
CVE-2008-5748 Chain: external control of values for user's desired language and theme
enables path traversal.
https://www.cve.org/CVERecord?id=CVE-2008-5748
CVE-2008-5764 Chain: external control of user's target language enables remote file inclusion.
https://www.cve.org/CVERecord?id=CVE-2008-5764
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 752 2009 Top 25 - Risky Resource Management 750 2353
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Maintenance
CWE-114 is a Class, but it is listed a child of CWE-73 in view 1000. This suggests some
abstraction problems that should be resolved in future versions.
Relationship
The external control of filenames can be the primary link in chains with other file-related
weaknesses, as seen in the CanPrecede relationships. This is because software systems use
files for many different purposes: to execute programs, load code libraries, to store application
data, to store configuration settings, record temporary data, act as signals or semaphores to
other processes, etc. However, those weaknesses do not always require external control. For
example, link-following weaknesses (CWE-59) often involve pathnames that are not controllable
by the attacker at all. The external control can be resultant from other issues. For example, in
PHP applications, the register_globals setting can allow an attacker to modify variables that
the programmer thought were immutable, enabling file inclusion (CWE-98) and path traversal
CWE Version 4.14
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component
('Injection')
CWE-74: Improper Neutralization of Special Elements in
Output Used by a Downstream Component ('Injection')