Weakness (CWE)
CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
More detail
Some of the most common variants of untrusted search path are:
- In various UNIX and Linux-based systems, the PATH environment variable may be consulted to locate executable programs, and LD_PRELOAD may be used to locate a separate library. Programming languages may have their own paths for locating code, e.g. PERL5LIB in Perl.
- In various Microsoft-based systems, the PATH environment variable is consulted to locate a DLL, if the DLL is not found in other paths that appear earlier in the search order.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
Source: MITRE CWE-426
75 results · Clear filters · Feed
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 4.6
Zoom Workplace Apps for Windows - Untrusted Search Path
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
-
Medium 4.5
Postman profapi.dll untrusted search path
A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity…
-
Medium 4.5
Discord profapi.dll untrusted search path
A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be…
-
Medium 4.5
obsproject OBS Studio untrusted search path
A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to be approached local…
-
Medium 4.5
Epic Games Launcher Installer profapi.dll untrusted search path
A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of the component Installer. The manipulation leads to untrusted search path. Attacking locally is a req…
-
Medium 5.3
libretro RetroArch Startup profapi.dll untrusted search path
A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted s…
-
Medium 5.8
pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion
The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't r…
-
Medium 6.7
A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 th…
-
Medium 5.3
Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.
Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. This issue affects Application…
-
Medium 6.7CVE-2024-6769 Public exploit
Medium to High Integrity Privilege Escalation in Microsoft Windows
A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medi…
-
Medium 5.8
DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable syste…
-
Medium 6.5
Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS - Untrusted Search Path
Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.
-
Medium 6.3
Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files …
-
Medium 6.3
Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid Software
This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system. Successful exploitation of this vulne…
-
Medium 6.7CVE-2023-36003 Public exploit
XAML Diagnostics Elevation of Privilege Vulnerability
XAML Diagnostics Elevation of Privilege Vulnerability
-
Medium 4.7
Adobe Acrobat Reader Untrusted Search Path Application denial-of-service
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Untrusted Search Path vulnerability that could lead to Application denial-of-service. An attacker could leverage this vulnerability if the default Power…
-
Medium 6.7
Local Privilege Escalation
Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrect file permissions t…
-
Medium 5.4
ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal…
-
Medium 4.2
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…
-
Medium 6.7
A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions …
-
Medium 6.3
Redis on Windows dbghelp.dll uncontrolled search path
A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated …
-
Medium 6.7
Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session
An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintentionally executed by ano…
-
Medium 4.4
Dell EMC PowerScale OneFS contains an untrusted search path vulnerability. This vulnerability allows a user with (ISI_P…
-
Medium 6.5
Adobe Creative Cloud Unquoted Service Path in CCXProcess
Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by an Unquoted Service Path vulnerability in CCXProcess that could allow an attacker to achieve arbitrary code execution in the process of the current user. Exploitation of this is…
-
Medium 6.2
Adobe Dreamweaver Untrusted Search Path Vulnerability Could Lead To Information Disclosure
Adobe Dreamweaver versions 21.0 (and earlier) and 20.2 (and earlier) is affected by an untrusted search path vulnerability that could result in information disclosure. An attacker with physical access to the system could replace certain configuration files an…
-
Medium 6.0
DLL Injection vulnerability in MA for Windows
DLL Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code via careful placement of a malicious DLL.
-
Medium 4.6
DLL search order hijacking in Host IPS
DLL Search Order Hijacking Vulnerability in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows prior to 8.0.0 Patch 15 Update allows attackers with local access to execute arbitrary code via execution from a compromised …
-
Medium 6.7
A symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3, could allow privileged fi…
-
Medium 6.7
A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version…
-
Medium 6.3
Untrusted Search Path Vulnerability in High-Level Antimalware SDK
Untrusted Search Path vulnerability in Bitdefender High-Level Antimalware SDK for Windows allows an attacker to load third party code from a DLL library in the search path. This issue affects: Bitdefender High-Level Antimalware SDK for Windows versions prior …
-
Medium 5.3
Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)
An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityServic…
-
Medium 5.2
Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.
-
Medium 5.1
All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerabil…
-
Medium 5.9
Apache Ranger policy engine incorrectly matches paths in certain conditions
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.