Book a Security Review

Weakness · High

CWE-59: Improper Link Resolution Before File Access ('Link Following')

What it is

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Likelihood of exploit: Medium17 exploited in the wildMITRE CWE 4.19.1

Severity (our rating)
High
Likelihood of exploit
Medium
Introduced during
Implementation
Exploited in the wild
17 known exploited CVEs

What an attacker can do

  • Read Files or Directories (Confidentiality, Integrity, Access Control)
  • Modify Files or Directories (Confidentiality, Integrity, Access Control)
  • Bypass Protection Mechanism (Confidentiality, Integrity, Access Control)
  • Execute Unauthorized Code or Commands (Other)

How to prevent it

Architecture and Design

  • Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

How to find it

  • Automated Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis
  • Manual Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
  • Dynamic Analysis with Automated Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners
  • Dynamic Analysis with Manual Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer
  • Manual Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)
  • Automated Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
  • Architecture or Design Review. According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

CWE-59 on MITRE's CWE site

Exploited in the wild: 17 CVEs

Vulnerabilities caused by CWE-59 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.

All known exploited vulnerabilities

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.