Improper link resolution before file access (link following) in .NET allows an authorized attacker to elevate privileges locally.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| .net | Microsoft | 8.0.0 (including) | 8.0.21 (excluding) |
| .net | Microsoft | 9.0.0 (including) | 9.0.10 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | dotnet8.0-0:8.0.121-1.el10_0 | * |
| Red Hat Enterprise Linux 10 | RedHat | dotnet9.0-0:9.0.111-1.el10_0 | * |
| Red Hat Enterprise Linux 10 | RedHat | dotnet10.0-0:10.0.100~rc.2.25502.107-0.12.el10_1 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet8.0-0:8.0.121-1.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet9.0-0:9.0.111-1.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet10.0-0:10.0.100~rc.2.25502.107-0.10.el9_7 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet8.0-0:8.0.121-1.el9_6 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet9.0-0:9.0.111-1.el9_6 | * |
| Red Hat Enterprise Linux 9.4 Extended Update Support | RedHat | dotnet8.0-0:8.0.121-1.el9_4 | * |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 | RedHat | devspaces/udi-rhel9:sha256:ef84715a61474b7a45b0b24c0d30370f51ab93ff86b70d5d345545253e01c3ae | * |
| Dotnet10 | Ubuntu | devel | * |
| Dotnet10 | Ubuntu | plucky | * |
| Dotnet10 | Ubuntu | questing | * |
| Dotnet7 | Ubuntu | jammy | * |
| Dotnet8 | Ubuntu | jammy | * |
| Dotnet8 | Ubuntu | noble | * |
| Dotnet8 | Ubuntu | plucky | * |
| Dotnet8 | Ubuntu | questing | * |
| Dotnet9 | Ubuntu | plucky | * |
| Dotnet9 | Ubuntu | questing | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html