Weakness (CWE)
CWE-428: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
How to prevent it (3 mitigations)
-
Implementation
Properly quote the full search path before executing a program on the system.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Source: MITRE CWE-428
359 results · Feed
-
Unscored —
SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability t…
-
High 7.3
Windows Unquoted/Trusted Service Paths
SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched.
-
High 8.3
Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.
-
Unscored —
A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted re…
-
Medium 5.2
Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrar…
-
Medium 6.7
Unquoted Path (SMB Login) Vulnerability
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerab…
-
Medium 6.7
Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and ...
Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect …
-
Medium 4.5
Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows
Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, t…
-
Medium 5.5
Unquoted Windows binary path in Traccar
Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes …
-
Unscored —CVE-2020-5147 Public exploit
SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to…
-
High 7.0
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server install…
-
High 7.8
Unquoted service executable path in McAfee Endpoint Security (ENS)
Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.
-
High 8.0
Unquoted service path vulnerability on Veyon
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students a…
-
Medium 6.6
File and Removable Media Protection update fixes one vulnerability
Unquoted service path vulnerability in McAfee File and Removable Media Protection (FRP) prior to 5.3.0 allows local users to execute arbitrary code, with higher privileges, via execution and from a compromised folder. This issue may result in files not being …
-
Unscored —
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the…
-
Medium 6.8
Unquoted Path in Rapid7 Nexpose Installer
Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.
-
High 7.3
An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that co…
-
Unscored —
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation…
-
Unscored —
A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (Al…
-
Unscored —
An unquoted search path vulnerability was reported in versions prior to 1.0.83.0 of the Synaptics Smart Audio UWP app a…
-
Medium 4.8
Unquoted service paths for some McAfee ENS files
Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file.
-
High 7.3
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation b…
-
Medium 4.2
Global Protect Agent: Local privilege escalation due to an unquoted search path vulnerability
An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the root of the OS disk (C:\) or to Program Files directory to gain system privileges. This issue affects …
-
Unscored —
Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not p…
-
Unscored —
Reliable Controls LicenseManager versions 3.4 and prior may allow an authenticated user to insert malicious code into t…
-
Medium 6.7
exacqVision Server Unquoted Service Path
ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This…
-
Unscored —
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without u…
-
Unscored —
In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), a…
-
Unscored —CVE-2018-10619 Public exploit
An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3…
-
Unscored —
Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02…
-
Unscored —
Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that…
-
Unscored —
An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow a…
-
Unscored —
An Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An unquoted sear…
-
Unscored —
An Unquoted Search Path issue was discovered in mySCADA myPRO Versions 7.0.26 and prior. Application services utilize u…
-
Unscored —
An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.…
-
Unscored —CVE-2017-9644 Public exploit
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteSca…
-
Medium 5.3CVE-2014-5455 Public exploit
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and Op…
-
Medium 5.9
Schneider Electric Floating License Manager Unquoted Search Path or Element
Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space cha…
-
High 7.8
Multiple unquoted Windows search path vulnerabilities in the (1) File Collector and (2) File PlaceHolder services in Sy…