CWE-1386, Insecure Operation on Windows Junction / Mount Point, describes a program that opens a file or directory without making sure the name has not been tied to a junction or mount point that leads outside the area the program meant to work in.
It mostly hits Windows services, installers and anti-malware tools that run with high privilege but touch folders a normal user can write to.
How it happens
NTFS supports reparse points. Two kinds matter here. A junction point links one directory to another directory. A mount point maps a directory to a drive letter. Either one lets a path that looks harmless resolve to somewhere else entirely.
Now picture a privileged service that writes a temporary file, a log or a rollback file into a folder the user controls. The attacker swaps that folder for a junction pointing at a sensitive location. The service opens the "same" path, and the operating system follows the link. The service then reads, writes or deletes a file it never intended to touch, using its own privileges.
MITRE also notes that the same trick can point at registry keys and semaphores, not only files.
A common trap is the check that runs before the open. If a program checks that a path is clean and opens it a moment later, the attacker has a window to swap it. MITRE ties this to a time-of-check to time-of-use race, CWE-367. One of the observed examples, CVE-2019-1161, is described as a chain where a race condition in an anti-malware product let files be deleted by creating a junction and using hard links while a temporary file existed.
What an attacker gains
The record lists three outcomes.
- Read files. Replace a user-controlled folder with a mount point and extra hard links, and the privileged program reads arbitrary files for you. CVE-2020-0863 is described that way.
- Modify files. Replace the rollback files in an installer directory and the installer runs your rollbacks.
- Deny service. Even without control of the contents, an arbitrary delete or overwrite as SYSTEM or admin can be permanent. Deleting a startup configuration file can keep a service from ever starting.
Other observed cases include CVE-2021-26426, where a privileged service let attackers delete unauthorized files through a directory junction, leading to code execution as SYSTEM, and CVE-2014-0568, a sandbox escape for a document reader through a mount point.
How to find it
The MITRE record lists no detection methods, so start with plain review.
- List every place your privileged code opens, creates or deletes files.
- For each one, ask who can write to the parent folder. If a standard user can, treat the path as hostile.
- Look for check then open sequences that are not atomic.
- Try it. Create a junction in the user writable folder, point it at a test file, and see what your program does.
How to fix it
MITRE's mitigation is separation of privilege during design.
- When software runs with more rights than the person invoking it, have it check that the files it uses are not improper hard links or mount points.
- On Windows, the command
dir /al /s /blists reparse points, and in PowerShell the LinkType property works as a filter. - Some software also signs the files it uses, so it can confirm it is using the right one.
- Make the check atomic with the file action. A separate check followed by an open brings back the race condition in CWE-367.
The simplest structural fix is to keep privileged work out of folders that unprivileged users can write to.
Quick check
Why is checking a path and then opening it not enough?
Because the attacker can swap the path between the check and the open. MITRE says to make the check atomic with the file action.
What is the difference between a junction and a mount point?
A junction links one directory to another directory. A mount point maps a directory to a drive letter. Both can redirect a path outside its intended area.
