CWE-67: Improper Handling of Windows Device Names
The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
Not properly handling virtual filenames (e.g. AUX, CON, PRN, COM1, LPT1) can result in different types of vulnerabilities. In some cases an attacker can request a device via injection of a virtual filename in a URL, which may cause an error that leads to a denial of service or an error page that reveals sensitive information. A product that allows device names to bypass filtering runs the risk of an attacker injecting malicious code in a file with the name of a device.
Consequences
- Availability, Confidentiality, Other: DoS: Crash, Exit, or Restart, Read Application Data, Other
How to prevent it
- Implementation: Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.
Recent advisories
- GHSA-c2f5-jxjv-2hh8 — Wasmtime doesn't fully sandbox all the Windows device filenames
- GHSA-49jc-r788-3fc9 — gix refs and paths with reserved Windows device names access the devices
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor