CWE-367
AllowedTime-of-check Time-of-use (TOCTOU) Race Condition
Abstraction: Base · Status: Incomplete
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
1204 vulnerabilities reference this CWE, most recent first.
GHSA-QMHJ-WG3R-X2H5
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2025-05-22 21:30Medtronic MyCareLink Smart 25000 all versions are vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.
{
"affected": [],
"aliases": [
"CVE-2020-27252"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-14T20:15:00Z",
"severity": "HIGH"
},
"details": "Medtronic MyCareLink Smart 25000 all versions are vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.",
"id": "GHSA-qmhj-wg3r-x2h5",
"modified": "2025-05-22T21:30:31Z",
"published": "2022-05-24T17:36:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27252"
},
{
"type": "WEB",
"url": "https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QMXG-RHXF-8273
Vulnerability from github – Published: 2026-07-28 15:32 – Updated: 2026-07-28 18:33When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.
{
"affected": [],
"aliases": [
"CVE-2026-62428"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-28T13:19:01Z",
"severity": "HIGH"
},
"details": "When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up. When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy.",
"id": "GHSA-qmxg-rhxf-8273",
"modified": "2026-07-28T18:33:02Z",
"published": "2026-07-28T15:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62428"
},
{
"type": "WEB",
"url": "https://xenbits.xenproject.org/xsa/advisory-500.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/16"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-500.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QPPM-G56G-FPVP
Vulnerability from github – Published: 2026-01-20 18:58 – Updated: 2026-01-21 21:11Summary
A race condition in Turbo Frames allows delayed HTTP responses to restore stale session cookies after session-modifying operations.
Details
Browsers automatically process Set-Cookie headers from HTTP responses. When a Turbo Frame request is in-flight during a session-modifying action (such as logout), the delayed response may include a Set-Cookie header reflecting the session state at request time. This can result in stale session cookies being restored after the session was intentionally modified or invalidated.
This condition can occur naturally on slow networks. An active network attacker capable of delaying responses could potentially exploit this to restore previous session state.
### Impact Applications using Turbo Frames with cookie-based session storage may experience: - Session state reversion after logout - Unintended restoration of previous authentication state
The impact is limited to applications using client-side cookie storage for sessions. Applications using server-side session stores (Redis, database, etc.) are not meaningfully affected, as the server-side session state remains authoritative.
Patches
Upgrade to Turbo 8.0.21 or later. The fix cancels in-flight Turbo Frame requests when: - The frame element is disconnected from the DOM - The frame's disabled attribute is set - The frame's src attribute is cleared
Workarounds
- Use server-side session storage instead of a cookie store like Rails's cookie store
- Ensure logout flows remove or disable Turbo Frame elements before invalidating sessions
References
- https://github.com/hotwired/turbo/pull/1399
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.0.20"
},
"package": {
"ecosystem": "npm",
"name": "@hotwired/turbo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.21"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66803"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-367",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-20T18:58:15Z",
"nvd_published_at": "2026-01-20T19:15:49Z",
"severity": "LOW"
},
"details": "### Summary\nA race condition in Turbo Frames allows delayed HTTP responses to restore stale session cookies after session-modifying operations.\n\n### Details\nBrowsers automatically process Set-Cookie headers from HTTP responses. When a Turbo Frame request is in-flight during a session-modifying action (such as logout), the delayed response may include a Set-Cookie header reflecting the session state at request time. This can result in stale session cookies being restored after the session was intentionally modified or invalidated.\n\nThis condition can occur naturally on slow networks. An active network attacker capable of delaying responses could potentially exploit this to restore previous session state.\n\n ### Impact\n Applications using Turbo Frames with cookie-based session storage may experience:\n - Session state reversion after logout\n - Unintended restoration of previous authentication state\n\nThe impact is limited to applications using client-side cookie storage for sessions. Applications using server-side session stores (Redis, database, etc.) are not meaningfully affected, as the server-side session state remains authoritative.\n\n### Patches\n Upgrade to Turbo 8.0.21 or later. The fix cancels in-flight Turbo Frame requests when:\n - The frame element is disconnected from the DOM\n - The frame\u0027s disabled attribute is set\n - The frame\u0027s src attribute is cleared\n\n### Workarounds\n - Use server-side session storage instead of a cookie store like Rails\u0027s cookie store\n - Ensure logout flows remove or disable Turbo Frame elements before invalidating sessions\n\n### References\n - https://github.com/hotwired/turbo/pull/1399",
"id": "GHSA-qppm-g56g-fpvp",
"modified": "2026-01-21T21:11:06Z",
"published": "2026-01-20T18:58:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hotwired/turbo/security/advisories/GHSA-qppm-g56g-fpvp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66803"
},
{
"type": "WEB",
"url": "https://github.com/hotwired/turbo/pull/1399"
},
{
"type": "WEB",
"url": "https://github.com/hotwired/turbo/commit/899df356e9f4b3303cca217cd14b3f846edda10d"
},
{
"type": "PACKAGE",
"url": "https://github.com/hotwired/turbo"
},
{
"type": "WEB",
"url": "https://github.com/hotwired/turbo/releases/tag/v8.0.21"
},
{
"type": "WEB",
"url": "https://turbo.hotwired.dev/handbook/frames"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Turbo Frame responses can restore stale session cookies"
}
GHSA-QRXG-7WRQ-3G62
Vulnerability from github – Published: 2023-07-19 03:30 – Updated: 2024-04-04 06:16IBM Spectrum Protect 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to due to improper time-of-check to time-of-use functionality. IBM X-Force ID: 256012.
{
"affected": [],
"aliases": [
"CVE-2023-33832"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-367"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-19T01:15:10Z",
"severity": "MODERATE"
},
"details": "IBM Spectrum Protect 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to due to improper time-of-check to time-of-use functionality. IBM X-Force ID: 256012.",
"id": "GHSA-qrxg-7wrq-3g62",
"modified": "2024-04-04T06:16:39Z",
"published": "2023-07-19T03:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33832"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/256012"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7011761"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QV2H-R7HX-HC93
Vulnerability from github – Published: 2023-06-27 00:30 – Updated: 2024-04-04 05:11A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.
Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This is similar to, but not identical to CVE-2023-32554.
{
"affected": [],
"aliases": [
"CVE-2023-32555"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-26T22:15:10Z",
"severity": "HIGH"
},
"details": "A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.\n\nPlease note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThis is similar to, but not identical to CVE-2023-32554.",
"id": "GHSA-qv2h-r7hx-hc93",
"modified": "2024-04-04T05:11:27Z",
"published": "2023-06-27T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32555"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-656"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QWQR-8X7G-3RR8
Vulnerability from github – Published: 2026-08-13 21:36 – Updated: 2026-08-13 21:36IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.
{
"affected": [],
"aliases": [
"CVE-2026-16967"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T20:17:17Z",
"severity": "HIGH"
},
"details": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.",
"id": "GHSA-qwqr-8x7g-3rr8",
"modified": "2026-08-13T21:36:06Z",
"published": "2026-08-13T21:36:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16967"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7283294"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QWQV-RQGF-8QH8
Vulnerability from github – Published: 2023-03-27 21:30 – Updated: 2024-05-20 21:50A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-0778"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-27T22:33:20Z",
"nvd_published_at": "2023-03-27T21:15:00Z",
"severity": "MODERATE"
},
"details": "A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.",
"id": "GHSA-qwqv-rqgf-8qh8",
"modified": "2024-05-20T21:50:04Z",
"published": "2023-03-27T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0778"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/pull/17528"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/pull/17532"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/commit/6ca857feb07a5fdc96fd947afef03916291673d8"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-0778"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168256"
},
{
"type": "PACKAGE",
"url": "https://github.com/containers/podman"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2023-1681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Podman Time-of-check Time-of-use (TOCTOU) Race Condition"
}
GHSA-QX57-Q6J5-G6MG
Vulnerability from github – Published: 2024-05-17 18:30 – Updated: 2024-05-17 18:30A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host
{
"affected": [],
"aliases": [
"CVE-2024-3290"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T17:15:07Z",
"severity": "HIGH"
},
"details": "A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host",
"id": "GHSA-qx57-q6j5-g6mg",
"modified": "2024-05-17T18:30:43Z",
"published": "2024-05-17T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3290"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2024-08"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QXJ7-2X7W-3MPP
Vulnerability from github – Published: 2025-02-19 17:47 – Updated: 2025-02-19 17:47Summary
Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other protocol parameters. Such usage is somewhat atypical, and only a small percentage of users are likely to be affected.
Details
Duende.AccessTokenManagement can request access tokens using the client credentials flow in several ways. In basic usage, the client credentials flow is configured once and the parameters do not vary. In more advanced situations, requests with varying protocol parameters may be made by calling specific overloads of these methods:
HttpContext.GetClientAccessTokenAsync()IClientCredentialsTokenManagementService.GetAccessTokenAsync()
There are overloads of both of these methods that accept a TokenRequestParameters object that customizes token request parameters. However, concurrent requests with varying TokenRequestParameters will result in the same token for all concurrent calls.
Upgrading
Most users can simply update the NuGet package to the latest version. Customizations of the IClientCredentialsTokenCache that derive from the default implementation (DistributedClientCredentialsTokenCache) will require a small code change, as its constructor was changed to add a dependency on the ITokenRequestSynchronization service. The synchronization service will need to be injected into the derived class and passed to the base constructor.
Impact
The impact of this vulnerability depends on how Duende.AccessTokenManagement is used and on the security architecture of the solution. Most users will not be vulnerable to this issue. More advanced users may run into this issue by calling the methods specified above with customized token request parameters. The impact of obtaining an access token with different than intended protocol parameters will vary depending on application logic, security architecture, and the authorization policy of the resource servers.
Thank you to Michael Dimoudis of PageUp for finding this issue and responsibly disclosing it!
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Duende.AccessTokenManagement"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-26620"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-19T17:47:19Z",
"nvd_published_at": "2025-02-18T18:15:36Z",
"severity": "MODERATE"
},
"details": "### Summary\nDuende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other protocol parameters. Such usage is somewhat atypical, and only a small percentage of users are likely to be affected.\n\n### Details\nDuende.AccessTokenManagement can request access tokens using the client credentials flow in several ways. In basic usage, the client credentials flow is configured once and the parameters do not vary. In more advanced situations, requests with varying protocol parameters may be made by calling specific overloads of these methods:\n\n- `HttpContext.GetClientAccessTokenAsync()`\n- `IClientCredentialsTokenManagementService.GetAccessTokenAsync()`\n\nThere are overloads of both of these methods that accept a `TokenRequestParameters` object that customizes token request parameters. However, concurrent requests with varying `TokenRequestParameters` will result in the same token for all concurrent calls.\n\n\n### Upgrading\nMost users can simply update the NuGet package to the latest version. Customizations of the `IClientCredentialsTokenCache` that derive from the default implementation (`DistributedClientCredentialsTokenCache`) will require a small code change, as its constructor was changed to add a dependency on the `ITokenRequestSynchronization` service. The synchronization service will need to be injected into the derived class and passed to the base constructor.\n\n### Impact\nThe impact of this vulnerability depends on how Duende.AccessTokenManagement is used and on the security architecture of the solution. Most users will not be vulnerable to this issue. More advanced users may run into this issue by calling the methods specified above with customized token request parameters. The impact of obtaining an access token with different than intended protocol parameters will vary depending on application logic, security architecture, and the authorization policy of the resource servers.\n\nThank you to **Michael Dimoudis** of **PageUp** for finding this issue and responsibly disclosing it!",
"id": "GHSA-qxj7-2x7w-3mpp",
"modified": "2025-02-19T17:47:19Z",
"published": "2025-02-19T17:47:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/DuendeSoftware/foss/security/advisories/GHSA-qxj7-2x7w-3mpp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26620"
},
{
"type": "WEB",
"url": "https://github.com/DuendeSoftware/foss/commit/a33332ddec0ebf3c048ba85427e3c77d47c68dac"
},
{
"type": "PACKAGE",
"url": "https://github.com/DuendeSoftware/foss"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens"
}
GHSA-QXP6-27GW-99CJ
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-12-13 15:58Due to a time-of-check to time-of-use (TOCTOU) race condition, the file browser for workspaces, archived artifacts, and $JENKINS_HOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2.
This allows attackers with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incorrectly applied fix for SECURITY-1452 / CVE-2021-21602 in the 2021-01-13 security advisory.
Jenkins 2.276, LTS 2.263.3 no longer differentiates the check and the use of symlinks in workspace browsers.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.263.2"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.263.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.275"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.264"
},
{
"fixed": "2.276"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21615"
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-23T06:50:38Z",
"nvd_published_at": "2021-01-26T18:16:00Z",
"severity": "MODERATE"
},
"details": "Due to a time-of-check to time-of-use (TOCTOU) race condition, the file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2.\n\nThis allows attackers with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, to create symbolic links that allow them to access files outside workspaces using the workspace browser.\n\nThis issue is caused by an incorrectly applied fix for SECURITY-1452 / CVE-2021-21602 in the [2021-01-13 security advisory](https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452).\n\nJenkins 2.276, LTS 2.263.3 no longer differentiates the check and the use of symlinks in workspace browsers.",
"id": "GHSA-qxp6-27gw-99cj",
"modified": "2022-12-13T15:58:50Z",
"published": "2022-05-24T17:40:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21615"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/01/26/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins"
}
Mitigation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Mitigation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Mitigation
Limit the interleaving of operations on files from multiple processes.
Mitigation
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
Mitigation
Recheck the resource after the use call to verify that the action was taken appropriately.
Mitigation
Ensure that some environmental locking mechanism can be used to protect resources effectively.
Mitigation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
CAPEC-27: Leveraging Race Conditions via Symbolic Links
This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to them. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file they will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.