Common Weakness Enumeration
CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
2237 vulnerabilities reference this CWE, most recent first.
GHSA-G9C2-GF25-3X67
Vulnerability from github – Published: 2026-04-01 00:25 – Updated: 2026-04-06 16:44
VLAI
Summary
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
Details
Summary
@tinacms/graphql uses string-based path containment checks in FilesystemBridge:
path.resolve(path.join(baseDir, filepath))startsWith(resolvedBase + path.sep)
That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed content root, a path like content/posts/pivot/owned.md is still considered "inside" the base even though the real filesystem target can be outside it.
As a result, FilesystemBridge.get(), put(), delete(), and glob() can operate on files outside the intended root.
Details
The current bridge validation is:
function assertWithinBase(filepath: string, baseDir: string): string {
const resolvedBase = path.resolve(baseDir);
const resolved = path.resolve(path.join(baseDir, filepath));
if (
resolved !== resolvedBase &&
!resolved.startsWith(resolvedBase + path.sep)
) {
throw new Error(
`Path traversal detected: "${filepath}" escapes the base directory`
);
}
return resolved;
}
But the bridge then performs real filesystem I/O on the resulting path:
public async get(filepath: string) {
const resolved = assertWithinBase(filepath, this.outputPath);
return (await fs.readFile(resolved)).toString();
}
public async put(filepath: string, data: string, basePathOverride?: string) {
const basePath = basePathOverride || this.outputPath;
const resolved = assertWithinBase(filepath, basePath);
await fs.outputFile(resolved, data);
}
public async delete(filepath: string) {
const resolved = assertWithinBase(filepath, this.outputPath);
await fs.remove(resolved);
}
This is a classic realpath gap:
- validation checks the lexical path string
- the filesystem follows the link target during I/O
- the actual target can be outside the intended root
This is reachable from Tina's GraphQL/local database flow. The resolver builds a validated path from user-controlled relativePath, but that validation is also string-based:
const realPath = path.join(collection.path, relativePath);
this.validatePath(realPath, collection, relativePath);
Database write and delete operations then call the bridge:
await this.bridge.put(normalizedPath, stringifiedFile);
...
await this.bridge.delete(normalizedPath);
Local Reproduction
This was verified llocally with a real junction on Windows, which exercises the same failure mode as a symlink on Unix-like systems.
Test layout:
- content root:
D:\bugcrowd\tinacms\temp\junction-repro4 - allowed collection path:
content/posts - junction inside collection:
content/posts/pivot -> D:\bugcrowd\tinacms\temp\junction-repro4\outside - file outside content root:
outside\secret.txt
Tina's current path-validation logic was applied and used to perform bridge-style read/write operations through the junction.
Observed result:
{
"graphqlBridge": {
"collectionPath": "content/posts",
"requestedRelativePath": "pivot/owned.md",
"validatedRealPath": "content\\posts\\pivot\\owned.md",
"bridgeResolvedPath": "D:\\bugcrowd\\tinacms\\temp\\junction-repro4\\content\\posts\\pivot\\owned.md",
"bridgeRead": "TOP_SECRET_FROM_OUTSIDE\\r\\n",
"outsideGraphqlWriteExists": true,
"outsideGraphqlWriteContents": "GRAPHQL_ESCAPE"
}
}
That is the critical point:
- the path was accepted as inside
content/posts - the bridge read
outside\secret.txt - the bridge wrote
outside\owned.md
So the current containment check does not actually constrain filesystem access to the configured content root once a link exists inside that tree.
Impact
- Arbitrary file read/write outside the configured content root
- Potential delete outside the configured content root via the same
assertWithinBase()gap indelete() - Breaks the assumptions of the recent path-traversal fixes because only lexical traversal is blocked
- Practical attack chains where the content tree contains a committed symlink/junction, or an attacker can cause one to exist before issuing GraphQL/content operations
The exact network exploitability depends on how the application exposes Tina's GraphQL/content operations, but the underlying bridge bug is real and independently security-relevant.
Recommended Fix
The containment check needs to compare canonical filesystem paths, not just string-normalized paths.
For example:
- resolve the base with
fs.realpath() - resolve the candidate path's parent with
fs.realpath() - reject any request whose real target path escapes the real base
- for write operations, carefully canonicalize the nearest existing parent directory before creating the final file
In short: use realpath-aware containment checks for every filesystem sink, not path.resolve(...).startsWith(...) alone.
Resources
packages/@tinacms/graphql/src/database/bridge/filesystem.tspackages/@tinacms/graphql/src/database/index.tspackages/@tinacms/graphql/src/resolver/index.ts
Severity
7.1 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.2.0"
},
"package": {
"ecosystem": "npm",
"name": "@tinacms/graphql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34604"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-01T00:25:22Z",
"nvd_published_at": "2026-04-01T17:28:41Z",
"severity": "HIGH"
},
"details": "## Summary\n\n`@tinacms/graphql` uses string-based path containment checks in `FilesystemBridge`:\n\n- `path.resolve(path.join(baseDir, filepath))`\n- `startsWith(resolvedBase + path.sep)`\n\nThat blocks plain `../` traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed content root, a path like `content/posts/pivot/owned.md` is still considered \"inside\" the base even though the real filesystem target can be outside it.\n\nAs a result, `FilesystemBridge.get()`, `put()`, `delete()`, and `glob()` can operate on files outside the intended root.\n\n## Details\n\nThe current bridge validation is:\n\n```ts\nfunction assertWithinBase(filepath: string, baseDir: string): string {\n const resolvedBase = path.resolve(baseDir);\n const resolved = path.resolve(path.join(baseDir, filepath));\n if (\n resolved !== resolvedBase \u0026\u0026\n !resolved.startsWith(resolvedBase + path.sep)\n ) {\n throw new Error(\n `Path traversal detected: \"${filepath}\" escapes the base directory`\n );\n }\n return resolved;\n}\n```\n\nBut the bridge then performs real filesystem I/O on the resulting path:\n\n```ts\npublic async get(filepath: string) {\n const resolved = assertWithinBase(filepath, this.outputPath);\n return (await fs.readFile(resolved)).toString();\n}\n\npublic async put(filepath: string, data: string, basePathOverride?: string) {\n const basePath = basePathOverride || this.outputPath;\n const resolved = assertWithinBase(filepath, basePath);\n await fs.outputFile(resolved, data);\n}\n\npublic async delete(filepath: string) {\n const resolved = assertWithinBase(filepath, this.outputPath);\n await fs.remove(resolved);\n}\n```\n\nThis is a classic realpath gap:\n\n1. validation checks the lexical path string\n2. the filesystem follows the link target during I/O\n3. the actual target can be outside the intended root\n\nThis is reachable from Tina\u0027s GraphQL/local database flow. The resolver builds a validated path from user-controlled `relativePath`, but that validation is also string-based:\n\n```ts\nconst realPath = path.join(collection.path, relativePath);\nthis.validatePath(realPath, collection, relativePath);\n```\n\nDatabase write and delete operations then call the bridge:\n\n```ts\nawait this.bridge.put(normalizedPath, stringifiedFile);\n...\nawait this.bridge.delete(normalizedPath);\n```\n\n## Local Reproduction\n\nThis was verified llocally with a real junction on Windows, which exercises the same failure mode as a symlink on Unix-like systems.\n\nTest layout:\n\n- content root: `D:\\bugcrowd\\tinacms\\temp\\junction-repro4`\n- allowed collection path: `content/posts`\n- junction inside collection: `content/posts/pivot -\u003e D:\\bugcrowd\\tinacms\\temp\\junction-repro4\\outside`\n- file outside content root: `outside\\secret.txt`\n\nTina\u0027s current path-validation logic was applied and used to perform bridge-style read/write operations through the junction.\n\nObserved result:\n\n```json\n{\n \"graphqlBridge\": {\n \"collectionPath\": \"content/posts\",\n \"requestedRelativePath\": \"pivot/owned.md\",\n \"validatedRealPath\": \"content\\\\posts\\\\pivot\\\\owned.md\",\n \"bridgeResolvedPath\": \"D:\\\\bugcrowd\\\\tinacms\\\\temp\\\\junction-repro4\\\\content\\\\posts\\\\pivot\\\\owned.md\",\n \"bridgeRead\": \"TOP_SECRET_FROM_OUTSIDE\\\\r\\\\n\",\n \"outsideGraphqlWriteExists\": true,\n \"outsideGraphqlWriteContents\": \"GRAPHQL_ESCAPE\"\n }\n}\n```\n\nThat is the critical point:\n\n- the path was accepted as inside `content/posts`\n- the bridge read `outside\\secret.txt`\n- the bridge wrote `outside\\owned.md`\n\nSo the current containment check does not actually constrain filesystem access to the configured content root once a link exists inside that tree.\n\n## Impact\n\n- **Arbitrary file read/write outside the configured content root**\n- **Potential delete outside the configured content root** via the same `assertWithinBase()` gap in `delete()`\n- **Breaks the assumptions of the recent path-traversal fixes** because only lexical traversal is blocked\n- **Practical attack chains** where the content tree contains a committed symlink/junction, or an attacker can cause one to exist before issuing GraphQL/content operations\n\nThe exact network exploitability depends on how the application exposes Tina\u0027s GraphQL/content operations, but the underlying bridge bug is real and independently security-relevant.\n\n## Recommended Fix\n\nThe containment check needs to compare canonical filesystem paths, not just string-normalized paths.\n\nFor example:\n\n1. resolve the base with `fs.realpath()`\n2. resolve the candidate path\u0027s parent with `fs.realpath()`\n3. reject any request whose real target path escapes the real base\n4. for write operations, carefully canonicalize the nearest existing parent directory before creating the final file\n\nIn short: use realpath-aware containment checks for every filesystem sink, not `path.resolve(...).startsWith(...)` alone.\n\n## Resources\n\n- `packages/@tinacms/graphql/src/database/bridge/filesystem.ts`\n- `packages/@tinacms/graphql/src/database/index.ts`\n- `packages/@tinacms/graphql/src/resolver/index.ts`",
"id": "GHSA-g9c2-gf25-3x67",
"modified": "2026-04-06T16:44:11Z",
"published": "2026-04-01T00:25:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-g9c2-gf25-3x67"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34604"
},
{
"type": "WEB",
"url": "https://github.com/tinacms/tinacms/commit/f124eabaca10dac9a4d765c9e4135813c4830955"
},
{
"type": "PACKAGE",
"url": "https://github.com/tinacms/tinacms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "@tinacms/graphql\u0027s `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions"
}
GHSA-G9CV-3H6Q-P67M
Vulnerability from github – Published: 2026-06-09 18:31 – Updated: 2026-06-09 18:31
VLAI
Details
Dell/Alienware Purchased Apps, versions prior to 1.1.32.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-44275"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T18:16:49Z",
"severity": "MODERATE"
},
"details": "Dell/Alienware Purchased Apps, versions prior to 1.1.32.0, contain an Improper Link Resolution Before File Access (\u0027Link Following\u0027) vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write",
"id": "GHSA-g9cv-3h6q-p67m",
"modified": "2026-06-09T18:31:03Z",
"published": "2026-06-09T18:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44275"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000472463/dsa-2026-250"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G9JW-2V7C-PPWJ
Vulnerability from github – Published: 2025-09-02 21:30 – Updated: 2025-09-02 21:30
VLAI
Details
Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
Severity
6.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-43726"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-02T19:15:31Z",
"severity": "MODERATE"
},
"details": "Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access (\u0027Link Following\u0027)\" vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.",
"id": "GHSA-g9jw-2v7c-ppwj",
"modified": "2025-09-02T21:30:58Z",
"published": "2025-09-02T21:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43726"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000361664/dsa-2025-336"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G9PC-F9FG-HRRQ
Vulnerability from github – Published: 2022-05-17 02:18 – Updated: 2022-05-17 02:18
VLAI
Details
scratchbox2 1.99.0.24 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/dpkg.#####.tmp, (b) /tmp/missing_deps.#####, and (c) /tmp/sb2-pkg-chk.$tstamp.##### temporary files, related to the (1) dpkg-checkbuilddeps and (2) sb2-check-pkg-mappings scripts.
{
"affected": [],
"aliases": [
"CVE-2008-4984"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-06T15:55:00Z",
"severity": "MODERATE"
},
"details": "scratchbox2 1.99.0.24 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/dpkg.#####.tmp, (b) /tmp/missing_deps.#####, and (c) /tmp/sb2-pkg-chk.$tstamp.##### temporary files, related to the (1) dpkg-checkbuilddeps and (2) sb2-check-pkg-mappings scripts.",
"id": "GHSA-g9pc-f9fg-hrrq",
"modified": "2022-05-17T02:18:28Z",
"published": "2022-05-17T02:18:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4984"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44907"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/496409"
},
{
"type": "WEB",
"url": "http://dev.gentoo.org/~rbu/security/debiantemp/scratchbox2"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.lenny.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30969"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G9RC-P3RQ-J6MC
Vulnerability from github – Published: 2022-05-17 05:11 – Updated: 2022-05-17 05:11
VLAI
Details
bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.
{
"affected": [],
"aliases": [
"CVE-2008-5374"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-12-08T23:30:00Z",
"severity": "MODERATE"
},
"details": "bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.",
"id": "GHSA-g9rc-p3rq-j6mc",
"modified": "2022-05-17T05:11:34Z",
"published": "2022-05-17T05:11:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5374"
},
{
"type": "WEB",
"url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43365"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51086"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201210-05.xml"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.sid.txt"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:004"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0261.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-1073.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32733"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0414"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GC42-WR8H-VR6F
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25
VLAI
Details
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
{
"affected": [],
"aliases": [
"CVE-2014-9512"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-02-12T16:59:00Z",
"severity": "MODERATE"
},
"details": "rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.",
"id": "GHSA-gc42-wr8h-vr6f",
"modified": "2022-05-13T01:25:01Z",
"published": "2022-05-13T01:25:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9512"
},
{
"type": "WEB",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=10977"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201605-04"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211168"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211170"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211171"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211175"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211289"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00041.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00095.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00112.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76093"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034786"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2879-1"
},
{
"type": "WEB",
"url": "http://xteam.baidu.com/?p=169"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GC5F-R48C-J357
Vulnerability from github – Published: 2022-05-17 04:50 – Updated: 2022-05-17 04:50
VLAI
Details
dmrc.c in Light Display Manager (aka LightDM) before 1.1.1 allows local users to read arbitrary files via a symlink attack on ~/.dmrc.
{
"affected": [],
"aliases": [
"CVE-2011-3153"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-03-06T15:55:00Z",
"severity": "LOW"
},
"details": "dmrc.c in Light Display Manager (aka LightDM) before 1.1.1 allows local users to read arbitrary files via a symlink attack on ~/.dmrc.",
"id": "GHSA-gc5f-r48c-j357",
"modified": "2022-05-17T04:50:26Z",
"published": "2022-05-17T04:50:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3153"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/883865"
},
{
"type": "WEB",
"url": "http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1299"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1262-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GC95-JC79-5Q6H
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2023-01-27 15:30
VLAI
Details
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2020-7040"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-21T21:15:00Z",
"severity": "HIGH"
},
"details": "storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)",
"id": "GHSA-gc95-jc79-5q6h",
"modified": "2023-01-27T15:30:31Z",
"published": "2022-05-24T17:07:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7040"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00003.html"
},
{
"type": "WEB",
"url": "https://seclists.org/oss-sec/2020/q1/20"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4508-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/01/20/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/01/21/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/01/22/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/01/22/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/01/23/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GCM7-32C7-5WRQ
Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2024-04-04 02:40
VLAI
Details
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2019-19191"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-21T18:15:00Z",
"severity": "HIGH"
},
"details": "Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.",
"id": "GHSA-gcm7-32c7-5wrq",
"modified": "2024-04-04T02:40:19Z",
"published": "2022-05-24T17:01:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19191"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1157471"
},
{
"type": "WEB",
"url": "https://issues.shibboleth.net/jira/browse/SSPCPP-874"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00017.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GCR9-32R6-7CX2
Vulnerability from github – Published: 2022-05-17 03:28 – Updated: 2022-05-17 03:28
VLAI
Details
GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.
{
"affected": [],
"aliases": [
"CVE-2015-4155"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-06-02T14:59:00Z",
"severity": "LOW"
},
"details": "GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.",
"id": "GHSA-gcr9-32r6-7cx2",
"modified": "2022-05-17T03:28:13Z",
"published": "2022-05-17T03:28:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4155"
},
{
"type": "WEB",
"url": "http://lists.gnu.org/archive/html/parallel/2015-04/msg00045.html"
},
{
"type": "WEB",
"url": "http://lists.gnu.org/archive/html/parallel/2015-05/msg00024.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74962"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Architecture and Design
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.