CWE-65 is the Windows counterpart to the Unix hard link problem. A program opens a file or directory by name and does not handle the case where the name is a hard link to a target outside the area it is meant to control.
It affects privileged Windows services and installers that work in directories other users can write to.
How it happens
A hard link gives one file a second name. If a privileged program uses a file in a location an attacker can write to, the attacker can replace that file with a hard link to something sensitive. MITRE's example is AUTOEXEC.BAT. When the process opens the file, the attacker can assume the privileges of that process, or prevent the program from accurately processing data.
What an attacker gains
MITRE lists confidentiality and integrity impact through reading and modifying files and directories. The extended description adds privilege escalation as a realistic outcome.
The observed examples include CVE-2002-0725, a file system that lets local attackers hide file usage activities via a hard link to the target, and CVE-2003-0844, a web server plugin that lets local users overwrite arbitrary files via a symlink attack on predictable temporary file names. Their Gold pages are CVE-2002-0725 and CVE-2003-0844.
How to find it
The record lists no detection methods. Review any privileged code that writes or opens files in shared or user-writable folders, and check what it assumes about the file it gets back.
How to fix it
MITRE's guidance is to apply least privilege when assigning access rights and to compartmentalize the system so there are protected areas that can be trusted. Denying an attacker access to a file or its folder stops them from replacing it with a link.
- Store files used by privileged code in folders only trusted accounts can change.
- Avoid predictable temporary file names in shared locations.
- Run the process with the minimum rights it needs.
Quick check
Why is a hard link hard to spot?
It is just another name for the same file, so the directory entry looks like any normal file.
