Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
952 results · Feed
-
Medium 6.7
Uncontrolled search path in some Intel(R) Rendering Toolkit software before version 2024.1.0 may allow an authenticated…
-
Medium 6.7
Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allo…
-
High 8.8
Sound Research SECOMN64 Escalation of Privilege
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. Sound Research has released driver updates to mitigate the potential vulnerabil…
-
Medium 6.0
Sound Research SECOMN64 Escalation of Privilege
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. Sound Research has released driver updates to mitigate the potential vulnerabil…
-
High 7.3
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications su…
-
Medium 5.9
Path Traversal in Safearchive
There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7…
-
Medium 6.3
Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to imp…
-
High 7.8CVE-2024-48605 Public exploit
An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper …
-
High 7.8
VSO ConvertXtoDvd ConvertXtoDvd.exe uncontrolled search path
A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83. Affected is an unknown function in the library avcodec.dll of the file ConvertXtoDvd.exe. The manipulation leads to uncontrolled search path. Attacking locally is a re…
-
High 7.8
OpenSight Software FlashFXP FlashFXP.exe uncontrolled search path
A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An attack h…
-
High 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files…
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files…
-
High 7.8
SolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
SolarWinds Platform is susceptible to an Uncontrolled Search Path Element Local Privilege Escalation vulnerability. This requires a low privilege account and local access to the affected node machine.
-
Low 2.5
HCL BigFix Platform is affected by a DLL Hijack vulnerability
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code w…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker …
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevat…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with ele…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with el…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with eleva…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elev…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with ele…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). gdb.exe in a…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). vish2.exe in…
-
High 7.3
Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
-
Medium 6.7CVE-2024-6769 Public exploit
Medium to High Integrity Privilege Escalation in Microsoft Windows
A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medi…
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.5
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.7
Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user…
-
Medium 5.3
RCE in desktop app in Windows by local attacker
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machi…
-
High 7.3
Cisco Meraki Systems Manager Agent for Windows Privilege Escalation Vulnerability
A vulnerability in Cisco Meraki Systems Manager (SM) Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. This vulnerability is due to incorrect handling of directory search paths at runtime.…
-
High 7.8
Local privilege escalation vulnerability in AVG Internet Security
Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.
-
Medium 6.7
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local aut…
-
High 8.8
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local au…
-
Medium 6.0
gix-path improperly resolves configuration path reported by Git
`gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their conversions. Prior to version 0.10.11, `gix-path` runs `git` to find the path of a configuration file associated with the `git` installation, …
-
High 7.8
Local privilege escalation in Overwolf
A local privilege escalation is caused by Overwolf loading and executing certain dynamic link library files from a user-writeable folder in SYSTEM context on launch. This allows an attacker with unprivileged access to the system to run arbitrary code with SYS…