CWE-69 is about a product that does not properly prevent access to, or detect the use of, alternate data streams (ADS) on Windows. The ::DATA suffix in the title is the name of the default stream, and it is the part attackers have abused in file names.
It matters to web servers that map URLs to files, to storage and quota tooling, and to anyone writing monitoring or security tools for Windows.
How it happens
A single Windows file can hold more than one stream of data. File browsers and the command line dir utility mostly show only the main one. That gap is the weakness.
MITRE describes two uses. An attacker can use an ADS to hide information about a file, such as its size or the name of a process, from the system or from file browsing tools. Or the attacker can bypass intended access restrictions for the associated data fork, because code that checks the plain file name does not check the stream name.
The observed examples show both. CVE-1999-0278 describes IIS where remote attackers obtain source code for ASP files by appending "::$DATA" to the URL, so the request reads the raw file instead of running it. CVE-2000-0927 describes a product that does not record file sizes properly when they are stored in alternate data streams, which lets users bypass quota restrictions. See CVE-1999-0278 and CVE-2000-0927.
What an attacker gains
MITRE lists three effects: bypassing a protection mechanism (access control), hiding activities (non-repudiation) and other impacts. In plain terms, an attacker can read files the server meant to protect, store data where tools do not look, and make their actions harder to trace.
How to find it
MITRE's detection note is simple: software tools are capable of finding ADSs on your system. So there are two angles.
- On systems you run, use tools that enumerate alternate streams and review what they report.
- In your own code, look for places where a user-supplied name or URL is turned into a path without checking for a stream separator, and for tools that report file size or usage using only the main stream.
How to fix it
MITRE's mitigation is for the implementation: ensure that the source code correctly parses the file name to read or write to the correct stream.
- Parse and normalize file names before any access decision, and decide explicitly whether stream names are allowed.
- Reject request paths that contain a stream separator unless you serve them on purpose.
- If you measure size or quota, include every stream.
Quick check
What did appending "::$DATA" do in CVE-1999-0278?
It made IIS return the source of an ASP file instead of executing it, because the request addressed the data stream directly.
What is MITRE's one-line fix for CWE-69?
Make sure the code correctly parses the file name so it reads or writes the intended stream.
