The product resolves symbolic or hard links without verifying the final target, enabling access outside intended files.
Resolve and verify final link targets; use O_NOFOLLOW / openat-style APIs where available.
MITRE ATT&CK techniques associated with this weakness class (mapped via MITRE CAPEC). A vulnerability of this type could let an adversary carry out:
A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.
Run attacker-chosen code or commands on the system.
Application logic and the host runtime — an attacker can execute arbitrary code or commands.
Least-privilege runtime, sandboxing, and safe deserialization/parsing.
Stay in even after reboots, patches, or credential changes.
Startup hooks, scheduled tasks, config, and accounts the attacker can plant a backdoor in.
Integrity monitoring of code, config, and scheduled tasks; short-lived credentials.
Gain higher privileges — from a limited account to admin/root.
Over-permissioned services, weak file/permission boundaries, and setuid paths.
Drop privileges, enforce least privilege, and lock down file permissions.
Keep a remote channel to control the compromised system.
Outbound network paths the attacker uses to receive commands and stage tools.
Egress filtering, DNS/traffic monitoring, and blocking anomalous outbound connections.
This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.