Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
318 results · Clear filters · Feed
-
Medium 6.7
Uncontrolled search path for the Intel(R) XTU software for Windows before version 7.14.2.14 may allow an authenticated …
-
Medium 6.7
Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow …
-
Medium 6.7
Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may all…
-
Medium 6.7
Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authent…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to po…
-
Medium 6.7
Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially …
-
Medium 6.7
Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family befo…
-
Medium 6.7
Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to poten…
-
Medium 6.7
Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authentica…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example s…
-
Medium 6.6
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.7
An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400…
-
Medium 6.7
Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation…
-
Medium 6.7
Uncontrolled search path in some Intel(R) oneAPI DPC++/C++ Compiler before version 2024.2 may allow an authenticated us…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may al…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Quartus(R) Prime Standard Edition software for Windows before version 23.1.1…
-
Medium 6.7
Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authentic…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an auth…
-
Medium 6.7
Uncontrolled search path for the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions ma…
-
Medium 6.7
Uncontrolled search path in the Intel(R) SDP Tool for Windows software all version may allow an authenticated user to p…
-
Medium 6.7
Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an a…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authen…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may al…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows before ver…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to po…
-
Medium 6.7
Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may al…
-
Medium 6.7
Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edit…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Rendering Toolkit software before version 2024.1.0 may allow an authenticated…
-
Medium 6.7
Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allo…
-
Medium 6.0
Sound Research SECOMN64 Escalation of Privilege
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. Sound Research has released driver updates to mitigate the potential vulnerabil…
-
Medium 5.9
Path Traversal in Safearchive
There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7…
-
Medium 6.3
Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to imp…
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). gdb.exe in a…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). vish2.exe in…
-
Medium 6.7CVE-2024-6769 Public exploit
Medium to High Integrity Privilege Escalation in Microsoft Windows
A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medi…
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.5
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…