1029
Untrusted Path :
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Access Control
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
There is the potential for arbitrary code execution with
privileges of the vulnerable program.
Availability DoS: Crash, Exit, or Restart
The program could be redirected to the wrong files,
potentially triggering a crash or hang when the targeted file
is too large or does not have the expected format.
Confidentiality Read Files or Directories
The program could send the output of unauthorized files to
the attacker.
Detection Methods
Black Box
Use monitoring tools that examine the software's process as it interacts with the operating
system and the network. This technique is useful in cases when source code is unavailable,
if the software was not developed by you, or if you want to verify that the build phase did
not introduce any new weaknesses. Examples include debuggers that directly attach to the
running process; system-call tracing utilities such as truss (Solaris) and strace (Linux); system
activity monitors such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities
(Windows); and sniffers and protocol analyzers that monitor network traffic. Attach the monitor
to the process and look for library functions and system calls that suggest when a search path is
being used. One pattern is when the program performs multiple accesses of the same file but in
different directories, with repeated failures until the proper filename is found. Library calls such
as getenv() or their equivalent can be checked to see if any path-related variables are being
accessed.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Manual Analysis
Use tools and techniques that require manual (human) analysis, such as penetration testing,
threat modeling, and interactive tools that allow the tester to record and modify an active session.
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Strategy = Attack Surface Reduction
CWE Version 4.14
CWE-426: Untrusted Search Path
CWE-426: Untrusted Search Path