CWE-72 covers software that does not properly handle special paths that identify the data or resource fork of a file on the HFS+ file system used by macOS.
It is mostly a concern for servers and tools that map requested names to files on a Mac and make decisions based on the name.
How it happens
HFS+ files can have more than one fork. If the product chooses its actions from the file name, an attacker who supplies a name that points at the data or resource fork can push the product into unexpected behavior. If the product tries to restrict access to a file, the attacker may still reach it by asking for the fork instead of the plain name.
The observed example is CVE-2004-1084, where a server lets remote attackers read files and resource fork content through HTTP requests to special file names related to multiple data streams in HFS+. See CVE-2004-1084.
What an attacker gains
MITRE lists confidentiality and integrity impact: reading and modifying files or directories that the access rules were meant to protect.
How to find it
The record has no detection methods. Test any server or tool that serves files from HFS+ by requesting the same file through its fork paths and compare the result with the plain request. If the answers differ, the access check is keyed on the name only.
How to fix it
The record lists no formal mitigations. The description points to the cause, so the fix is to resolve each requested name to the real resource before applying rules, and to apply the same restriction to every form the name can take. Keep sensitive files outside the served directory.
Quick check
Why can a restriction on a file name fail on HFS+?
The data or resource fork can be requested through a different path, and a check that only looks at the plain name does not cover it.
