116
Nature Type ID Name Page
MemberOf 748 CERT C Secure Coding Standard (2008) Appendix -
POSIX (POS)
734 2351
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 884 CWE Cross-section 884 2567
MemberOf 980 SFP Secondary Cluster: Link in Resource Name
Resolution
888 2409
MemberOf 1185 SEI CERT Perl Coding Standard - Guidelines 07. File
Input and Output (FIO)
1178 2468
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Notes
Theoretical
Link following vulnerabilities are Multi-factor Vulnerabilities (MFV). They are the combination
of multiple elements: file or directory permissions, filename predictability, race conditions, and
in some cases, a design limitation in which there is no mechanism for performing atomic file
creation operations. Some potential factors are race conditions, permissions, and predictability.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Link Following
CERT C Secure Coding FIO02-C Canonicalize path names originating
from untrusted sources
CERT C Secure Coding POS01-
C
Check for the existence of links when
dealing with files
SEI CERT Perl Coding
Standard
FIO01-
PL
CWE More Specific Do not operate on files that can be
modified by untrusted users
Software Fault Patterns SFP18 Link in resource name resolution
Related Attack Patterns
CAPEC-ID Attack Pattern Name
17 Using Malicious Files
35 Leverage Executable Code in Non-Executable Files
76 Manipulating Web Input to File System Calls
132 Symlink Attack
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-1282]Snyk. "Zip Slip Vulnerability". 2018 June 5. < https://security.snyk.io/research/zip-slipvulnerability
>.
CWE-61: UNIX Symbolic Link (Symlink) Following
Weakness ID : 61
Structure : Composite
Abstraction : Compound
Description
CWE Version 4.14
CWE-61: UNIX Symbolic Link (Symlink) Following
CWE-61: UNIX Symbolic Link (Symlink) Following