CWE-59: Improper Link Resolution Before File Access ('Link Following')

Executive Impact

• Confidentiality,Integrity,Access Control: Read Files or Directories,Modify Files or Directories,Bypass Protection Mechanism: An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
• Other: Execute Unauthorized Code or Commands: Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.

Developer Pattern

CWE-59 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.

Confidence

high confidence from CWE-59, 4.20.