CWE-459 is Incomplete Cleanup. The product does not properly clean up and remove temporary or supporting resources after use.
Temp files, scratch directories, session artifacts and open streams all count. It affects any application that creates something it later needs to destroy.
How it happens
The code creates a resource and then forgets to delete it, or only deletes it on the happy path. MITRE's Java example shows the second case. A stream is closed inside the try block, so an exception thrown before close() leaves the resource open:
try {
InputStream is = new FileInputStream(path);
byte b[] = new byte[is.available()];
is.read(b);
is.close();
} catch (Throwable t) {
log.error("Something bad happened: " + t.getMessage());
}
The correct form releases the stream in a finally block, or uses try with resources:
try (InputStream is = new FileInputStream(path)) {
byte b[] = new byte[is.available()];
is.read(b);
} catch (Throwable t) {
log.error("Something bad happened: " + t.getMessage());
}
Observed examples:
- CVE-2000-0552: a world-readable temporary file was not deleted after use.
- CVE-2005-2293: a temporary file was not deleted after use, leaking database usernames and passwords.
- CVE-2002-0788: an interaction error created a temporary file that could not be deleted because of strong permissions.
- CVE-2002-2066: NTFS alternate data streams were not cleared when files were wiped.
What an attacker gains
MITRE lists reading and modifying application data, plus resource consumption. Directories typically limit how many files they can hold, so a flood of leftover temp files can create a denial of service.
How to find it
MITRE notes that static analysis (SAST) can find some instances by modeling data flow. By hand:
- Search for every place that creates a temp file or opens a handle, and confirm a matching delete or close on every path, including error paths.
- Look in temp directories after tests for files that should be gone.
- Check permissions on anything left behind.
How to fix it
MITRE's mitigation: temporary files and other supporting resources should be deleted or released immediately after they are no longer needed. Use finally blocks, try with resources, or the equivalent in your language, and set restrictive permissions on temp files while they exist.
Quick check
Why does cleanup in the try block fail?
If an exception occurs before the cleanup line, it never runs. Put it in a finally block or use a construct that releases automatically.
