562
if(is_link($filename)){
$realFile = readlink($filename);
}
if(fileowner($realFile) == $user){
echo file_get_contents($realFile);
return;
}
else{
echo 'Access denied';
writeLog($user . ' attempted to access the file '. $filename . ' on '. date('r'));
}
}
While the code logs a bad access attempt, it logs the user supplied name for the file, not the
canonicalized file name. An attacker can obscure their target by giving the script the name of a link
to the file they are attempting to access. Also note this code contains a race condition between the
is_link() and readlink() functions (CWE-363).
Observed Examples
Reference Description
CVE-2002-0725 Attacker performs malicious actions on a hard link to a file, obscuring the real
target file.
https://www.cve.org/CVERecord?id=CVE-2002-0725
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 997 SFP Secondary Cluster: Information Loss 888 2418
MemberOf 1413 Comprehensive Categorization: Protection Mechanism
Failure
1400 2542
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Obscured Security-relevant Information
by Alternate Name
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
Weakness ID : 226
Structure : Simple
Abstraction : Base
Description
The product releases a resource such as memory or a file so that it can be made available for
reuse, but it does not clear or "zeroize" the information contained in the resource before the product
performs a critical state transition or makes the resource available for reuse by other entities.
Extended Description
CWE Version 4.14
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-226: Sensitive Information in Resource Not Removed Before Reuse