Umbra Wiki weakness weakness/CWE-64
Back to wiki

CWE-64 — Windows Shortcut Following (.LNK)

provenance: imported · CWE: CWE-64

CWE-64: Windows Shortcut Following (.LNK)

MITRE CWE weakness

Kind Weakness
Abstraction Variant
Status Incomplete
Likelihood of exploit Low

Description

The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Common consequences

  • Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

Mitigations

Architecture and Design — Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References

  • CWE page: https://cwe.mitre.org/data/definitions/64.html
  • CWE list: https://cwe.mitre.org/data/index.html