111
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Windows (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Files or Directories
Read arbitrary files by replacing a user-controlled folder
with a mount point and additional hard links.
Integrity Modify Files or Directories
Modify an arbitrary file by replacing the rollback files in
installer directories, as they can have the installer execute
those rollbacks.
Availability Modify Files or Directories
Even if there is no control of contents, an arbitrary file
delete or overwrite (when running as SYSTEM or admin)
can be used for a permanent system denial-of-service, e.g.
by deleting a startup configuration file that prevents the
service from starting.
Potential Mitigations
Phase: Architecture and Design
Strategy = Separation of Privilege
When designing software that will have different rights than the executer, the software should
check that files that it is interacting with are not improper hard links or mount points. One way
to do this in Windows is to use the functionality embedded in the following command: "dir /al /s /
b" or, in PowerShell, use LinkType as a filter. In addition, some software uses authentication via
signing to ensure that the file is the correct one to use. Make checks atomic with the file action,
otherwise a TOCTOU weakness (CWE-367) can be introduced.
Observed Examples
Reference Description
CVE-2021-26426 Privileged service allows attackers to delete unauthorized files using a
directory junction, leading to arbitrary code execution as SYSTEM.
https://www.cve.org/CVERecord?id=CVE-2021-26426
CVE-2020-0863 By creating a mount point and hard links, an attacker can abuse a service to
allow users arbitrary file read permissions.
https://www.cve.org/CVERecord?id=CVE-2020-0863
CVE-2019-1161 Chain: race condition (CWE-362) in anti-malware product allows deletion of
files by creating a junction (CWE-1386) and using hard links during the time
window in which a temporary file is created and deleted.
https://www.cve.org/CVERecord?id=CVE-2019-1161
CVE-2014-0568 Escape from sandbox for document reader by using a mountpoint [REF-1264]
https://www.cve.org/CVERecord?id=CVE-2014-0568
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-1389: Incorrect Parsing of Numbers with Different Radices
CWE-1389: Incorrect Parsing of Numbers with Different Radices