1417
The following code uses input from an HTTP request to create a file name. The programmer has
not considered the possibility that an attacker could provide a file name such as "../../tomcat/conf/
server.xml", which causes the application to delete one of its own configuration files (CWE-22).
Example Language: Java (Bad)
String rName = request.getParameter("reportName");
File rFile = new File("/usr/local/apfr/reports/" + rName);
...
rFile.delete();
Example 3:
The following code uses input from a configuration file to determine which file to open and
echo back to the user. If the program runs with privileges and malicious users can change the
configuration file, they can use the program to read any file on the system that ends with the
extension .txt.
Example Language: Java (Bad)
fis = new FileInputStream(cfg.getProperty("sub")+".txt");
amt = fis.read(arr);
out.println(arr);
Example 4:
This program is intended to execute a command that lists the contents of a restricted directory,
then performs other actions. Assume that it runs with setuid privileges in order to bypass the
permissions check by the operating system.
Example Language: C (Bad)
#define DIR "/restricted/directory"
char cmd[500];
sprintf(cmd, "ls -l %480s", DIR);
/* Raise privileges to those needed for accessing DIR. */
RaisePrivileges(...);
system(cmd);
DropPrivileges(...);
...
This code may look harmless at first, since both the directory and the command are set to fixed
values that the attacker can't control. The attacker can only see the contents for DIR, which is the
intended program behavior. Finally, the programmer is also careful to limit the code that executes
with raised privileges.
However, because the program does not modify the PATH environment variable, the following
attack would work:
Example Language: (Attack)
• The user sets the PATH to reference a directory under the attacker's control, such as "/my/dir/".
• The attacker creates a malicious program called "ls", and puts that program in /my/dir
• The user executes the program.
• When system() is executed, the shell consults the PATH to find the ls program
• The program finds the attacker's malicious program, "/my/dir/ls". It doesn't find "/bin/ls" because PATH does not
contain "/bin/".
• The program executes the attacker's malicious program with the raised privileges.
Example 5:
CWE Version 4.14
CWE-642: External Control of Critical State Data
CWE-642: External Control of Critical State Data