Weakness · High
CWE-67: Improper Handling of Windows Device Names
What it is
The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
- Severity (our rating)
- High
- Likelihood of exploit
- High
- Introduced during
- Implementation, Operation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Not properly handling virtual filenames (e.g. AUX, CON, PRN, COM1, LPT1) can result in different types of vulnerabilities. In some cases an attacker can request a device via injection of a virtual filename in a URL, which may cause an error that leads to a denial of service or an error page that reveals sensitive information. A product that allows device names to bypass filtering runs the risk of an attacker injecting malicious code in a file with the name of a device.
What an attacker can do
- DoS: Crash, Exit, or Restart (Availability, Confidentiality, Other)
- Read Application Data (Availability, Confidentiality, Other)
- Other (Availability, Confidentiality, Other)
How to prevent it
Implementation
- Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.