Skip to content
OpenAdvisories

Weakness (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following

Compound Incomplete

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

How to prevent it (2 mitigations)

  1. Implementation

    Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.

  2. Architecture and Design

    Follow the principle of least privilege when assigning access rights to entities in a software system.

    Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE-61

All Critical High Medium Low Exploited only Public exploit

219 results · Feed

  • High 7.3
    CVE-2021-32554

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32553

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32551

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32552

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32550

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32548

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32549

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32547

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • Medium 6.8
    CVE-2021-25322

    python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root

    A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperK…

    openSUSE Factory Leap 15.2 hyperkitty Ubuntu
  • Unscored —
    CVE-2020-15076

    Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not hav…

  • Unscored —
    CVE-2020-15075

    OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access…

  • Medium 6.5
    CVE-2021-1145

    Cisco StarOS for Cisco ASR 5000 Series Routers Arbitrary File Read Vulnerability

    A vulnerability in the Secure FTP (SFTP) of Cisco StarOS for Cisco ASR 5000 Series Routers could allow an authenticated, remote attacker to read arbitrary files on an affected device. To exploit this vulnerability, the attacker would need to have valid creden…

    Cisco Cisco ASR 5000 Series Software Network devices
  • High 7.7
    CVE-2020-8014

    kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackage

    A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with the privileges of the kopano user to escalate to root. This issue affects: openSUSE Leap 15.1 kopan…

    openSUSE openSUSE Leap 15.1 openSUSE Tumbleweed
  • High 7.7
    CVE-2020-8019

    syslog-ng: Local privilege escalation from new to root in %post

    A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11…

    SUSE openSUSE openSUSE Leap 15.1 SUSE Linux Enterprise Server 11-SP4-LTSS Linux
  • Medium 4.8
    CVE-2019-11251

    kubectl cp allows symlink directory traversal

    The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in th…

    Kubernetes Kubernetes k8s.io/kubernetes Go
  • High 7.7
    CVE-2019-16775

    Unauthorized File Access in npm CLI before before version 6.13.3

    Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.j…

    npm cli npm npm Debian Ubuntu npm
  • Medium 4.8
    CVE-2019-11249

    kubectl cp allows symlink directory traversal

    The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If…

    Kubernetes Kubernetes k3s Alpine
  • Medium 6.4
    CVE-2019-11246

    kubectl cp allows symlink directory traversal

    The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If…

    Kubernetes Kubernetes
  • High 7.3
    CVE-2017-14798 Public exploit

    local privilege escalation in SUSE postgresql init script

    A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.

    SUSE postgresql-init