Falhas do tipo CWE-61

159 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2024-54661CRITICALreadline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.EPSS 0.8%CVE-2024-22014HIGHAn issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via SymbolEPSS 0.8%CVE-2025-3047MEDIUMPath Traversal in AWS SAM CLI allows file copy to build containerEPSS 0.7%CVE-2025-31133HIGHrunc container escape via "masked path" abuse due to mount race conditionsEPSS 0.7%CVE-2026-39861HIGHClaude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceEPSS 0.7%CVE-2024-42367MEDIUMIn aiohttp, compressed files as symlinks are not protected from path traversalEPSS 0.6%CVE-2025-3048MEDIUMPath Traversal in AWS SAM CLI allows file copy to local cacheEPSS 0.6%CVE-2026-27489HIGHONNX: Path Traversal via SymlinkEPSS 0.6%CVE-2021-39134HIGHUNIX Symbolic Link (Symlink) Following in @npmcli/arboristEPSS 0.6%CVE-2026-49248HIGHOneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untarEPSS 0.6%CVE-2026-56748HIGHAuthenticated RCE via Symlink Following in Cribl Stream Pack Git ImportEPSS 0.6%CVE-2025-52565HIGHcontainer escape due to /dev/console mount and related racesEPSS 0.6%CVE-2024-47515HIGHPagure: generate_archive() follows symbolic links in temporary clonesEPSS 0.6%CVE-2021-39135HIGHUNIX Symbolic Link (Symlink) Following in @npmcli/arboristEPSS 0.6%CVE-2024-52535HIGHDell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symboliEPSS 0.5%CVE-2024-47877MEDIUMExtract has insufficient checks allowing attacker to create symlinks outside the extraction directory.EPSS 0.5%CVE-2020-8019HIGHsyslog-ng: Local privilege escalation from new to root in %postEPSS 0.5%CVE-2025-52881HIGHrunc: LSM labels can be bypassed with malicious config using dummy procfs filesEPSS 0.5%CVE-2025-59343HIGHtar-fs has a symlink validation bypass if destination directory is predictable with a specific tarballEPSS 0.5%CVE-2025-29787HIGHzip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File WriteEPSS 0.5%