CWE-427Uncontrolled Search Path Element

Description

Common consequences· 1

• Confidentiality / Integrity / Availability — Execute Unauthorized Code or Commands

Potential mitigations· 5

• [Architecture and Design, Implementation]Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
• [Implementation]When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
• [Implementation]Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
• [Implementation]Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
• [Implementation]Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.

Related CAPEC attack patterns· 2

Exploits (incoming)2

Compliance frameworks addressing this (incoming)1

(incoming)30

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.