CWE-610 describes a product that uses an externally controlled name or reference that resolves to a resource outside the intended control sphere. It is a broad category, and many better-known weaknesses sit beneath it, such as path traversal and open redirects.
How it happens
The pattern is always the same. Input names something, the application resolves the name, and nobody checks that the result is inside the area the user is supposed to reach.
# Vulnerable pattern: a file name from the request, resolved as-is
@app.get("/logs")
def logs():
return open("/var/app/logs/" + request.args["file"]).read()
The "resource" can be a file, a URL, a class name, or a remote object.
MITRE's observed examples show how different these look.
- CVE-2022-3032: an email client did not block loading of remote objects in a nested document.
- CVE-2022-45918: a chain in which a learning management tool debugger used external input to locate previous session logs and did not properly validate the path, allowing filesystem path traversal.
- CVE-2018-1000613: a cryptography API used unsafe reflection when deserializing a private key.
- CVE-2020-11053: a chain in a Go-based OAuth2 reverse proxy that could send the authenticated user to another site at the end of the authentication flow.
What an attacker gains
The record lists two outcomes. An adversary could read or modify data, depending on how the resource is used. And one who can supply a reference to an unintended resource can potentially access something they have no privileges for, bypassing existing access controls.
How to find it
Make a list of every place where request data picks a file, URL, host, class, or object, and test each with a value that points outside the expected area. Because this category covers many specific weaknesses, scanners that look for path traversal, open redirect, and server-side request patterns each find a slice of it.
How to fix it
The record does not list mitigations for this category itself, so look to the specific child weakness. The common thread is to stop trusting the reference.
- Map identifiers to resources through a fixed table, so the user chooses an ID and never a path or URL.
- Where a name must be accepted, accept only known good values and reject the rest.
- After resolving a reference, confirm the result is still inside the intended directory, host, or namespace.
SAFE = {"app": "/var/app/logs/app.log", "audit": "/var/app/logs/audit.log"}
path = SAFE.get(request.args.get("file"))
if path is None: abort(404)
Quick check
What is the "sphere" in this weakness?
The boundary of resources the user is meant to reach. A reference that resolves outside it is the problem.
