CWE-61: UNIX Symbolic Link (Symlink) Following

A product may allow symlinks to participate in paths supplied through internal code or user input. If an attacker can create, replace, or control a symlink before the product uses the path, the link may resolve outside the intended location and enable file-system traversal or access to arbitrary files. Depending on the operation, the product may read, write, or corrupt data that the attacker could not otherwise access; the risk is especially significant for privileged programs and temporary directories that can be manipulated.

This weakness occurs when a path can contain a symlink but the product does not adequately validate the location to which the link resolves. An attacker can spoof or replace the link so that the product operates outside its intended control sphere, particularly during temporary-file handling, privileged operations, backup or archive processing, and error handling. The resulting operation may read, modify, or corrupt files without the attacker's direct authorization.

The primary impacts are confidentiality and integrity. An attacker may read files or directories that should be inaccessible, or modify files and directories, including overwriting, appending to, or corrupting arbitrary files.

• Restrict temporary storage: When a program creates a temporary directory for files or links, restrict access to that directory so attackers cannot manipulate its contents.
• Apply least privilege and separation of privilege: Limit access rights and deny access to files where possible, reducing the ability to replace them with links to sensitive files. Use sound compartmentalization to create protected, trusted areas of the system.

Automated static analysis, commonly called Static Application Security Testing or SAST, can identify some instances by analyzing source or compiled code without execution. It typically models data flow and control flow, then searches for potentially vulnerable patterns connecting input sources to sinks where data reaches the operating system or another external component. The record describes this as capable of finding some instances, not as a complete detection method.

The following are representative examples from the record, not an exhaustive list:

• CVE-1999-1386: Some Perl versions follow symlinks with the -e option, allowing local users to overwrite arbitrary files.
• CVE-2000-1178: A text editor follows symlinks while creating a rescue copy, allowing local users to overwrite other users' files.
• CVE-2004-0217: An antivirus updater allows arbitrary files to be created or appended to through a symlink attack on a logfile.
• CVE-2000-0972: A setuid product permits file reading by replacing an edited file with a symlink to the target and exposing the result in parsing error messages.
• CVE-2005-1879 and CVE-2005-1880: Second-order symlink vulnerabilities.
• CVE-2015-3629: A Libcontainer component in Docker Engine allows local users to escape containerization and write to an arbitrary host file through a symlink in an image.
• CVE-2020-26277: A MySQL database deployment tool processes a malicious tarball containing symlinks outside the target, which leads to execution after unpacking.
• CVE-2021-21272: A Zip Slip vulnerability in an OCI registry product allows writing outside the intended directory through symlinks or hard links in a gzipped tarball.
• The record also lists CVE-2003-0517, CVE-2004-0689, CVE-2005-1916, and CVE-2005-0824 as related examples involving file overwriting, a symlink in a Python program, or a signal-triggered dump that follows symlinks.