Improper link resolution before file access (link following) in .NET allows an unauthorized attacker to perform tampering locally.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| .net | Microsoft | 8.0.0 (including) | 8.0.28 (excluding) |
| .net | Microsoft | 9.0.0 (including) | 9.0.17 (excluding) |
| .net | Microsoft | 10.0.0 (including) | 10.0.9 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | dotnet8.0-0:8.0.128-1.el10_2 | * |
| Red Hat Enterprise Linux 10 | RedHat | dotnet9.0-0:9.0.118-1.el10_2 | * |
| Red Hat Enterprise Linux 10 | RedHat | dotnet10.0-0:10.0.109-1.el10_2 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | dotnet8.0-0:8.0.128-1.el10_0 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | dotnet9.0-0:9.0.118-1.el10_0 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet8.0-0:8.0.128-1.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet9.0-0:9.0.118-1.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet10.0-0:10.0.109-1.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet8.0-0:8.0.128-1.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet9.0-0:9.0.118-1.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet10.0-0:10.0.109-1.el9_8 | * |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | RedHat | dotnet8.0-0:8.0.128-1.el9_4 | * |
| Red Hat Enterprise Linux 9.6 Extended Update Support | RedHat | dotnet8.0-0:8.0.128-1.el9_6 | * |
| Red Hat Enterprise Linux 9.6 Extended Update Support | RedHat | dotnet9.0-0:9.0.118-1.el9_6 | * |
| Red Hat Hardened Images | RedHat | dotnet9-0-main-9.0.117-1.hum1 | * |
| Red Hat Hardened Images | RedHat | dotnet10-0-main-10.0.109-1.hum1 | * |
| Red Hat Hardened Images | RedHat | dotnet8-0-main-8.0.128-1.hum1 | * |
| Dotnet10 | Ubuntu | devel | * |
| Dotnet10 | Ubuntu | noble | * |
| Dotnet10 | Ubuntu | questing | * |
| Dotnet10 | Ubuntu | resolute | * |
| Dotnet10 | Ubuntu | stonking | * |
| Dotnet7 | Ubuntu | jammy | * |
| Dotnet8 | Ubuntu | jammy | * |
| Dotnet8 | Ubuntu | noble | * |
| Dotnet8 | Ubuntu | questing | * |
| Dotnet9 | Ubuntu | questing | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html