CWE-64 Windows快捷方式跟随（.LNK）

Windows Shortcut Following (.LNK)

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: Low

基本描述

The software, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files.

扩展描述

The shortcut (file with the .lnk extension) can permit an attacker to read/write a file that they originally did not have permissions to access.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 59 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 59 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

Operating_System: {'cwe_Class': 'Windows', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
['Confidentiality', 'Integrity']	['Read Files or Directories', 'Modify Files or Directories']

可能的缓解方案

MIT-48.1 Architecture and Design

策略: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

分析过的案例

标识	说明	链接
CVE-2000-0342	Mail client allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka "Stealth Attachment."	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0342
CVE-2001-1042	FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1042
CVE-2001-1043	FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1043
CVE-2005-0587	Browser allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0587
CVE-2001-1386	".LNK." - .LNK with trailing dot	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1386
CVE-2003-1233	Rootkits can bypass file access restrictions to Windows kernel directories using NtCreateSymbolicLinkObject function to create symbolic link	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1233

Notes

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Windows Shortcut Following (.LNK)
CERT C Secure Coding	FIO05-C		Identify files using multiple file attributes
Software Fault Patterns	SFP18		Link in resource name resolution