CWE-59: Improper Link Resolution Before File Access ('Link Following')

low-risk

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Abstraction: Base

Common Consequences

Confidentiality → Read Files or Directories
Other → Execute Unauthorized Code or Commands

Detection Methods

Automated Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis

Manual Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies

Dynamic Analysis with Automated Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

Real-World Examples (10)

CVE CVSS EPSS KEV
CVE-2022-30333 7.5 92.8% Y
CVE-2019-0841 7.8 82.7% Y
CVE-2019-0841 7.8 82.7% Y
CVE-2024-32002 9.0 80.4% —
CVE-2023-40028 4.9 77.6% —
CVE-2022-21999 7.8 71.3% Y
CVE-2022-21999 7.8 71.3% Y
CVE-2023-36874 7.8 71.2% Y
CVE-2020-36193 7.5 71.1% Y
CVE-2020-36193 7.5 71.1% Y
7
/ 100
low-risk
Active Threat 4/50 · Minimal
Exploit Availability 3/50 · Minimal