CWE-64—Windows Shortcut Following (.LNK)

Weakness Name

Windows Shortcut Following (.LNK)

Description

The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Common Consequences

Scope:

Confidentiality, Integrity

Impact:

Read Files or Directories, Modify Files or Directories

Notes:

The shortcut (file with the .lnk extension) can permit an attacker to read/write a file that they originally did not have permissions to access.

Related Weaknesses

• CWE-59Improper Link Resolution Before File Access ('Link Following')Medium