Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
319 results · Clear filters · Feed
-
Medium 6.7
Uncontrolled search path in some Intel(R) Advisor software before version 2024.0 may allow an authenticated user to pot…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Processor Identification Utility software before versions 6.10.34.1129, 7.1.6…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro Edition Design software before version 23.4 may allow an…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may all…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow a…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Computing Improvement Program software before version 2.4.0.10654 may allow …
-
Medium 6.7
Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user …
-
Medium 6.7
Uncontrolled search path in some Intel(R) GPA software before version 2023.4 may allow an authenticated user to potenti…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Processor Diagnostic Tool software before version 4.1.9.41 may allow an authe…
-
Medium 4.2
EMS SQL Manager 3.6.2 (build 55333) for Oracle allows DLL hijacking: a user can trigger the execution of arbitrary code…
-
Medium 6.7
Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user…
-
Medium 6.7
Local Privilege Escalation via DLL Hijacking
A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are …
-
Medium 6.7
Uncontrolled search path element in some Intel(R) SSU software before version 3.0.0.2 may allow an authenticated user t…
-
Medium 6.7
Uncontrolled search path for some Intel(R) MPI Library Software before version 2021.11 may allow an authenticated user …
-
Medium 6.7
Uncontrolled search path in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow a privillaged user…
-
Medium 6.7
Uncontrolled search path in some Intel(R) ISPC software before version 1.21.0 may allow an authenticated user to potent…
-
Medium 6.7
Uncontrolled search path in some Intel(R) SDK for OpenCL(TM) Applications software may allow an authenticated user to p…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Battery Life Diagnostic Tool software before version 2.3.1 may allow an authe…
-
Medium 6.7
Uncontrolled search path in Intel(R) QSFP+ Configuration Utility software, all versions, may allow an authenticated use…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Binary Configuration Tool software before version 3.4.4 may allow an authenti…
-
Medium 6.7
Uncontrolled search path in some Intel(R) CIP software before version 2.4.10577 may allow an authenticated user to pote…
-
Medium 6.7
Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.2 may all…
-
Medium 6.7
Uncontrolled search path in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to pote…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated us…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a…
-
Medium 6.5
IBM Db2 code execution
IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file…
-
Medium 6.3
Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims in…
-
Medium 5.3
PeaZip Library dragdropfilesdll.dll uncontrolled search path
A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. …
-
Medium 5.3CVE-2023-6401 Public exploit
NotePad++ dbghelp.exe uncontrolled search path
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The ide…
-
Medium 6.5
Uncontrolled Search Path Element Vulnerability in 4D and 4D Windows Server
An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vulnerability consists in a DLL hijacking by replacing x64 shfolder.dll in the installation path, causi…
-
Medium 6.3
Uncontrolled search path element vulnerability in Plesk
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll…
-
Medium 6.0
Arbitrary File Read
Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows access to files with sensitive information. This issue affects Pandora FMS: from 700 through 772.
-
Medium 6.7
Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may all…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an a…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) RealSense(TM) Dynamic Calibration software before version 2.13.1.0 ma…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) Server Information Retrieval Utility software before version 16.0.9 m…
-
Medium 6.7
Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenti…
-
Medium 6.7
Uncontrolled search path in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potent…
-
Medium 6.7
Uncontrolled search path in some Intel(R) NUC 12 Pro Kits & Mini PCs - NUC12WS Intel(R) HID Event Filter Driver install…
-
Medium 6.7
Uncontrolled search path in some Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation softwar…