CWE-57
Weakness AllowedPath Equivalence: 'fakedir/../realdir/filename'
Abstraction: Variant · Status: Incomplete
The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.
Mapping guidance
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Notes
Theoretical
This is a manipulation that uses an injection for one consequence (containment violation using relative path) to achieve a different consequence (equivalence by alternate name).
Content history
updated Time_of_Introduction
updated Relationships, Other_Notes, Taxonomy_Mappings
updated Description, Name, Observed_Examples, Other_Notes, Theoretical_Notes
updated Common_Consequences
updated Observed_Examples, Relationships
updated Potential_Mitigations
updated Relationships, Taxonomy_Mappings
updated Applicable_Platforms
updated Relationships
updated Observed_Examples, Potential_Mitigations
updated Description
updated Relationships
updated Mapping_Notes
updated Affected_Resources, Functional_Areas
updated Applicable_Platforms, Weakness_Ordinalities
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
No CAPEC attack patterns related to this CWE.