CWE-67 applies when a product builds pathnames from user input and does not handle a pathname containing a Windows device name such as AUX or CON. It typically leads to a denial of service or an information exposure when the application tries to treat the name as a regular file.
Anyone running Windows-hosted web servers or file handling code that turns request data into paths should care.
How it happens
Names such as AUX, CON, PRN, COM1 and LPT1 are virtual filenames. An attacker can request a device by injecting one into a URL. The application tries to process it like a file, which can raise an error that crashes the process or produces an error page that reveals sensitive information.
MITRE adds that a product that lets device names slip past filtering also risks an attacker injecting malicious code in a file with the name of a device.
The observed examples are mostly old web servers. CVE-2002-0200 is a server that can be pushed into a denial of service by an HTTP request for an MS-DOS device name, and CVE-2002-1052 describes MS-DOS device names in HTTP requests being used to cause a denial of service or obtain the physical path of the server. See CVE-2002-0200 and CVE-2002-1052.
What an attacker gains
MITRE lists availability impact (crash, exit or restart), confidentiality impact (reading application data) and other effects. The two outcomes to expect are a service that falls over and an error message that tells the attacker more than it should.
How to find it
The record lists no detection methods. A simple test is to send requests or upload names that use device names, including with an extension added, and watch for hangs, crashes or verbose errors.
How to fix it
MITRE's guidance is short. Be familiar with the device names in the operating system where your system is deployed, and check input for these device names.
- Keep a list of reserved device names for each platform you run on.
- Reject any user-supplied path component that matches one, before it reaches the file system.
- Return a generic error so failures do not reveal internals.
Quick check
Which two outcomes does MITRE highlight for CWE-67?
Denial of service and information exposure, both caused by the application treating a device name as a regular file.
