CWE-64: Windows Shortcut Following (.LNK)
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
扩展描述
The shortcut (file with the .lnk extension) can permit an attacker to read/write a file that they originally did not have permissions to access.
常见后果
影响范围: Confidentiality Integrity
技术影响: Read Files or Directories Modify Files or Directories
潜在缓解措施
阶段: Architecture and Design
策略: Separation of Privilege
观察示例
参考: CVE-2019-19793
network access control service executes program with high privileges and allows symlink to invoke another executable or perform DLL injection.
参考: CVE-2000-0342
Mail client allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka "Stealth Attachment."
参考: CVE-2001-1042
FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
参考: CVE-2001-1043
FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
参考: CVE-2005-0587
Browser allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.
参考: CVE-2001-1386
".LNK." - .LNK with trailing dot
参考: CVE-2003-1233
Rootkits can bypass file access restrictions to Windows kernel directories using NtCreateSymbolicLinkObject function to create symbolic link
引入模式
| 阶段 | 说明 |
|---|---|
| Operation | - |
适用平台
编程语言
操作系统
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| PLOVER | - | Windows Shortcut Following (.LNK) | - |
| CERT C Secure Coding | FIO05-C | Identify files using multiple file attributes | - |
| Software Fault Patterns | SFP18 | Link in resource name resolution | - |