CWE-64 covers software that opens a file or directory without handling the case where the file is a Windows shortcut (.LNK) pointing outside the area the software is meant to control. The software ends up operating on files it was not supposed to touch.
This one affects anything on Windows that accepts files or file names from other people: file servers, mail clients, upload handlers and services running with high privileges.
How it happens
A shortcut is a small file that points at another file. If an application treats it like any ordinary file and follows it, the target decides what actually gets read or written. An attacker who can put a shortcut in a place the application trusts can aim it at a file the attacker could not otherwise reach.
The observed examples show a few flavors. Several FTP server issues, such as CVE-2001-1042 and CVE-2001-1043, describe remote attackers reading arbitrary files and directories by uploading a .lnk file. Another, CVE-2019-19793, is a network access control service that executes a program with high privileges and allows a symlink to invoke another executable or perform DLL injection. A third, CVE-2000-0342, let a mail client user warning for executable attachments be bypassed with a .lnk file that refers to the attachment. See CVE-2001-1042, CVE-2019-19793 and CVE-2000-0342.
What an attacker gains
MITRE lists confidentiality and integrity impact. The shortcut can let an attacker read or write a file they did not originally have permission to access, because the privileged application does the access for them.
How to find it
The record has no detection methods listed, so use review:
- Find code paths that open files from locations users can write to, especially in services running as a high-privilege account.
- Check whether the code looks at the file type before opening it, or simply opens whatever the name resolves to.
- Test by placing a .lnk file in an upload or watch directory and see whether the service reads the target.
How to fix it
MITRE points to least privilege and compartmentalization. Deny access to files and directories so an attacker cannot drop a shortcut where privileged code will find it, and keep protected areas that can be trusted.
In practice:
- Make directories that privileged code reads writable only by trusted accounts.
- Run services with the lowest privilege that still works.
- Reject or ignore shortcut files in upload and processing paths unless following them is an explicit feature.
Quick check
What is the core mistake behind CWE-64?
Opening a file without handling the fact that it is a shortcut whose target lies outside the intended control sphere.
