Weakness (CWE)
CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
How to prevent it (8 mitigations)
-
Architecture and Design
When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
-
Architecture and Design, Operation
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory.
Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
-
Implementation
Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59).
-
Installation, Operation
Use OS-level permissions and run as a low-privileged user to limit the scope of any successful attack.
-
Operation, Implementation
If you are using PHP, configure your application so that it does not use register_globals. During implementation, develop your application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
-
Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Source: MITRE CWE-73
281 results · Clear filters · Feed
-
Medium 4.7
ForU CMS channel.php file inclusion
A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched…
-
Medium 6.5
An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVide…
-
Medium 6.5
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of …
-
Medium 6.5
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of …
-
Medium 6.5
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of …
-
Medium 6.3CVE-2024-0265 EPSS 21%
SourceCodester Clinic Queuing System GET Parameter index.php file inclusion
A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component GET Parameter Handler. The manipulation of the argument page leads to file…
-
Medium 5.5
SourceCodester Simple Student Attendance System index.php file inclusion
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclus…
-
Medium 5.5
AVEVA Operations Control Logger External Control of File Name or Path
This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.
-
Medium 6.5
A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authent…
-
Medium 5.2
Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially…
-
Medium 6.5
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interp…
-
Medium 6.5
A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platfor…
-
Medium 6.3
SourceCodester Inventory Management System index.php file inclusion
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the …
-
Medium 4.4
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or over…
-
Medium 5.4
Windows HTML Platforms Security Feature Bypass Vulnerability
Windows HTML Platforms Security Feature Bypass Vulnerability
-
Medium 6.3
SourceCodester Resort Reservation System index.php file inclusion
A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The a…
-
Medium 6.5
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
-
Medium 4.4
PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface
A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.
-
Medium 6.5CVE-2023-29324 Public exploit
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
-
Medium 6.5
Moodle: tinymce loaders susceptible to arbitrary folder creation
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
-
Medium 5.3
SourceCodester Student Study Center Desk Management System index.php file inclusion
A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file …
-
Medium 6.5
The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read
The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SV…
-
Medium 6.5
Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server
A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.
-
Medium 5.0
sternenseemann sternenblog main.c blog_index file inclusion
A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main.c. The manipulation of the argument post_path leads to file inclusion. The attack may be initiated …
-
Medium 6.3
soshtolsus wing-tight index.php file inclusion
A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of the argument p leads to file inclusion. It is possible to initiate the attack remotely. Upgrading to…
-
Medium 5.3
perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL.
-
Medium 6.5
Alertmanager can expose local files content via specially crafted config
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertm…
-
Medium 6.5
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and d…
-
Medium 6.5
An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit…
-
Medium 5.3
External Control of File Name or Path in dompdf/dompdf
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
-
Medium 5.5
A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware …
-
Medium 4.9
Cisco Unified Communications Products Arbitrary File Write Vulnerability
A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to write arbitrary files on…
-
Medium 4.4
Cisco Firepower Threat Defense Software CLI Arbitrary File Write Vulnerability
A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. T…
-
Medium 4.4
Cisco ADE-OS Local File Inclusion Vulnerability
A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to identify directories and write arbitrary files to…
-
Medium 6.5CVE-2021-27250 EPSS 67%
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-L…
-
Medium 5.3CVE-2021-21343 EPSS 47%
XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…
-
Medium 5.8
Absolute path traversal vulnerability in QES
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
-
Medium 4.9
Cisco IoT Field Network Director File Overwrite Vulnerability
A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected system. The vulnerability is due to insufficient file system protections. An attacker could exploit th…
-
Medium 5.9
Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names
The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic…
-
Medium 6.2
Arbitrary File Deletion vulnerability in OctoberCMS
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend u…