目標達成 すべての支援者に感謝 — 100%達成しました!

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%

CWE-39 路径遍历:’C:dirname’ 类漏洞列表 1

CWE-39 路径遍历:’C:dirname’ 类弱点 1 条 CVE 漏洞汇总,含 AI 中文分析。

CWE-39 是一种路径遍历漏洞,特指攻击者利用 Windows 驱动器盘符(如 C:)或卷标来重定向文件访问。当应用程序未对用户输入进行严格校验时,攻击者可构造包含盘符的恶意路径,绕过预期目录限制,读取或写入系统任意位置的敏感文件。开发者应通过白名单机制严格过滤输入,确保路径仅指向允许的目录,并避免直接拼接用户提供的路径字符串,从而有效防止此类安全威胁。

MITRE CWE 官方描述
CWE:CWE-39 路径遍历:'C:dirname' 英文:该产品接受包含驱动器字母或 Windows 卷字母('C:dirname')的输入,这可能会将访问重定向到非预期的位置或任意文件。
常见影响 (4)
Integrity, Confidentiality, AvailabilityExecute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
IntegrityModify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow …
ConfidentialityRead Files or Directories
The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing a…
AvailabilityDoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the software from working at all and in the case of a protection mechanisms such as authentication, it has the potential to lockout every user of the s…
缓解措施 (2)
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Effectiveness: High
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CVE IDタイトルCVSS深刻度公開日
CVE-2017-16609 Netgain Enterprise Manager 安全漏洞 — NetGain Systems Enterprise Manager 7.5 -2018-01-23

CWE-39(路径遍历:’C:dirname’) 是常见的弱点类别,本平台收录该类弱点关联的 1 条 CVE 漏洞。