Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.
CWE-64 Variant Incomplete
Windows Shortcut Following (.LNK)
This vulnerability occurs when an application opens a file or directory without properly validating that it is a Windows shortcut (.LNK). If the shortcut's target points to a location outside the…
Definition
What is CWE-64?
This vulnerability occurs when an application opens a file or directory without properly validating that it is a Windows shortcut (.LNK). If the shortcut's target points to a location outside the application's intended security boundary, an attacker can trick the software into accessing unauthorized files.
Windows shortcut files (.LNK) contain a reference to a target file or folder, but they are separate objects with their own permissions. An application that fails to resolve the shortcut's final destination before performing operations can be manipulated. An attacker can place a malicious .LNK file in a location the application trusts, but configure it to point to a sensitive system file or a directory they shouldn't have access to, effectively bypassing intended access controls.
This allows for unauthorized file reads or writes. For example, an application designed to process user-uploaded files in a sandboxed folder could be tricked into reading the Windows SAM database or overwriting a critical configuration file because it blindly follows the shortcut. The core security failure is not canonicalizing the path to the shortcut's true target and checking if that resolved path is within the allowed scope before proceeding.
Auswirkungen in der Praxis
Real-world CVEs caused by CWE-64
-
network access control service executes program with high privileges and allows symlink to invoke another executable or perform DLL injection.
-
Mail client allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka "Stealth Attachment."
-
FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
-
FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
-
Browser allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.
-
".LNK." - .LNK with trailing dot
-
Rootkits can bypass file access restrictions to Windows kernel directories using NtCreateSymbolicLinkObject function to create symbolic link
Wie Angreifer es ausnutzen
Angreiferpfad Schritt für Schritt
- 1
Identifiziere einen Codepfad, der nicht vertrauenswürdige Eingaben ohne Validierung verarbeitet.
- 2
Erzeuge eine Payload, die das unsichere Verhalten auslöst — Injection, Traversal, Overflow oder Logik-Missbrauch.
- 3
Liefere die Payload über einen normalen Request aus und beobachte die Reaktion der Anwendung.
- 4
Iteriere, bis die Antwort Daten preisgibt, Angreifer-Code ausführt oder Berechtigungen eskaliert.
Verwundbares Codebeispiel
Vulnerable pseudo
MITRE hat kein Codebeispiel für diese CWE veröffentlicht. Das untenstehende Muster ist illustrativ — kanonische Referenzen findest du unter Ressourcen.
// Example pattern — see MITRE for the canonical references.
function handleRequest(input) {
// Untrusted input flows directly into the sensitive sink.
return executeUnsafe(input);
} Sicheres Codebeispiel
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste
How to prevent CWE-64
- Architecture and Design Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Erkennungssignale
How to detect CWE-64
Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.
Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.
Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.
CWE-64
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Häufig gestellte Fragen Was ist CWE-64?
Wie gravierend ist CWE-64?
Welche Sprachen oder Plattformen sind von CWE-64 betroffen?
Wie kann ich CWE-64 verhindern?
Wie erkennt und behebt Plexicus CWE-64?
Wo erfahre ich mehr über CWE-64?
Frequently asked questions
Was ist CWE-64?
This vulnerability occurs when an application opens a file or directory without properly validating that it is a Windows shortcut (.LNK). If the shortcut's target points to a location outside the application's intended security boundary, an attacker can trick the software into accessing unauthorized files.
Wie gravierend ist CWE-64?
MITRE stuft die Exploit-Wahrscheinlichkeit als niedrig ein — eine Ausnutzung ist selten, die Schwachstelle sollte aber dennoch behoben werden, sobald sie entdeckt wird.
Welche Sprachen oder Plattformen sind von CWE-64 betroffen?
MITRE lists the following affected platforms: Windows.
Wie kann ich CWE-64 verhindern?
Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Wie erkennt und behebt Plexicus CWE-64?
Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-64 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.
Wo erfahre ich mehr über CWE-64?
MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/64.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.
Verwandte Schwachstellen
Weaknesses related to CWE-64
CWE-59 Parent
Improper Link Resolution Before File Access ('Link Following')
This vulnerability occurs when an application uses a filename to access a file but fails to properly check if that name points to a…
CWE-1386 Sibling
Insecure Operation on Windows Junction / Mount Point
This vulnerability occurs when a Windows application opens a file or directory without properly validating that the path is not a symbolic…
CWE-61 Sibling
UNIX Symbolic Link (Symlink) Following
This vulnerability occurs when a software application opens files or directories without properly checking if they are symbolic links…
CWE-62 Sibling
UNIX Hard Link
This vulnerability occurs when an application opens a file or directory without verifying if the name points to a hard link that leads…
CWE-65 Sibling
Windows Hard Link
This vulnerability occurs when a Windows application opens a file or directory without properly verifying if the path points to a hard…
Bereit, das Wesentliche zu validieren?
Bereit zu validieren, was zählt.
Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.