Weakness (CWE)
CWE-1386: Insecure Operation on Windows Junction / Mount Point
The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.
More detail
If a file is used by a
privileged program, but it can be replaced
with a hard link to a sensitive file (e.g.,
AUTOEXEC.BAT), an attacker could escalate
privileges. When the process opens the file,
the attacker can assume the privileges of
that process, tricking the privileged
process to read, modify, or delete the
sensitive file, preventing the program from
accurately processing data. Note that one
can also point to registries and
semaphores.
How to prevent it (1 mitigation)
-
Architecture and Design
When designing software that will have different rights than the executer, the software should check that files that it is interacting with are not improper hard links or mount points. One way to do this in Windows is to use the functionality embedded in the following command: "dir /al /s /b" or, in PowerShell, use LinkType as a filter. In addition, some software uses authentication via signing to ensure that the file is the correct one to use. Make checks atomic with the file action, otherwise a TOCTOU weakness (CWE-367) can be introduced.
Source: MITRE CWE-1386
18 results · Feed
-
Medium 4.3
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the install…
-
Critical 9.8
Root.Mkdir(All) can follow junctions out of the root on Windows in os
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the la…
-
Medium 4.1
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write file…
-
Medium 6.3
Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Lin…
-
High 8.8
Privilege escalation during the installation of Norton Secure VPN via the Microsoft Store
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to elevatio…
-
Medium 6.6
A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, po…
-
High 8.5
Local privilege escalation in ESET products for Windows
The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so.
-
Medium 6.3
DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A l…
-
Medium 6.6
Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount p…
-
Low 3.8
Vagrant’s Windows Installer Allowed Directory Junction Write
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.
-
Medium 6.2
Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)
SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the op…
-
Medium 5.0
Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows Junction / Mount Point vulner…
-
Medium 6.7
Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Wind…
-
Medium 6.3
Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on…
-
Medium 4.7
Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during u…
-
Medium 4.7
Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerabil…
-
Medium 5.5
Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on …
-
High 8.2
NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experie…