Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
952 results · Feed
-
High 7.3
D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the abili…
-
Medium 6.7
Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user …
-
Medium 6.7
Uncontrolled search path in some Intel(R) GPA software before version 2023.3 may allow an authenticated user to potenti…
-
Medium 6.7
Uncontrolled search path in Intel(R) Graphics Command Center Service bundled in some Intel(R) Graphics Windows DCH driv…
-
Medium 6.7
Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated…
-
Medium 6.7
Uncontrolled search path for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to pot…
-
Medium 6.7
Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticate…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authen…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenti…
-
Medium 6.7
Uncontrolled search path in some Intel(R) PCM software before version 202311 may allow an authenticated user to potenti…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Distribution for GDB software before version 2024.0 may allow an authenticat…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to p…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Advisor software before version 2024.0 may allow an authenticated user to pot…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Processor Identification Utility software before versions 6.10.34.1129, 7.1.6…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro Edition Design software before version 23.4 may allow an…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may all…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow a…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Computing Improvement Program software before version 2.4.0.10654 may allow …
-
Medium 6.7
Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user …
-
Medium 6.7
Uncontrolled search path in some Intel(R) GPA software before version 2023.4 may allow an authenticated user to potenti…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Processor Diagnostic Tool software before version 4.1.9.41 may allow an authe…
-
High 7.2
Insecure Loading of Code in B&R Products
An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R …
-
High 7.8
Ashlar-Vellum Lithium Uncontrolled Search Path Element Remote Code Execution Vulnerability
Ashlar-Vellum Lithium Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Lithium. User interaction is required to exploit this v…
-
High 7.8
Ashlar-Vellum Xenon Uncontrolled Search Path Element Remote Code Execution Vulnerability
Ashlar-Vellum Xenon Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Xenon. User interaction is required to exploit this vulne…
-
High 7.8
Ashlar-Vellum Argon Uncontrolled Search Path Element Remote Code Execution Vulnerability
Ashlar-Vellum Argon Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Argon. User interaction is required to exploit this vulne…
-
High 7.8
Ashlar-Vellum Cobalt Uncontrolled Search Path Element Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vul…
-
High 7.0
3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability
3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 3CX. An attacker must first obtain the ability to execute low-privileged code on the target sy…
-
Medium 4.2
EMS SQL Manager 3.6.2 (build 55333) for Oracle allows DLL hijacking: a user can trigger the execution of arbitrary code…
-
High 8.4
IBM i privilege escalation
IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled…
-
High 7.7
An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged t…
-
High 7.8
VT STUDIO Ver.8.32 and earlier contains an issue with the DLL search path, which may lead to insecurely loading Dynamic…
-
High 7.4
Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability. A …
-
High 7.8
Uncontrolled search path element issue exists in SonicDICOM Media Viewer 2.3.2 and earlier, which may lead to insecurel…
-
High 7.1
The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to ex…
-
High 7.8
EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer…
-
High 7.8
Claris International has fixed a dylib hijacking vulnerability in the FileMaker Pro.app and Claris Pro.app versions on …
-
High 8.4
IBM i privilege escalation
Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 280203.
-
High 7.9
SanDisk PrivateAccess DLL Hijacking Vulnerability
A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vulnerability is only exploitable locally if an attacker has access to a copy of t…
-
High 8.8CVE-2024-0670 Public exploit
Privilege escalation in windows agent
Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) allows local user to escalate privileges
-
High 7.3
electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to ope…