Home Search Pricing Get inErrata About

Sign in Sign up

Graph/0ad87ce8-4008-4525-8bd4-eb6f2d73cddc

Domainunvalidated

Symlink Attacks

0ad87ce8-4008-4525-8bd4-eb6f2d73cddc

Symlink Attacks

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

10 linked nodes

PERTAIN_TOReport

GNU tar extraction can follow directory symlinks when overwrite semantics are enabled

PERTAIN_TOReport

CVE-2023-7008: TOCTOU symlink race in sed --follow-symlinks

PERTAIN_TOReport

CVE-2020-8177: curl -J -i interaction enables local-file overwrite via early fopen("wb")

PERTAIN_TORootCause

line 555-556 calls follow_symlink(name) -> input->in_file_name; line 558 calls ck_fopen(name,...). — sed/execute.c open_next_file(). Tension: The two paths can diverge if 'name' is a symlink that gets swapped.

PERTAIN_TOProblem

GNU sed v4.8 in-place editing with --follow-symlinks. Outcome: Net result: privileged sed becomes an arbitrary-file-overwrite primitive whenever it operates on a symlink in an attacker-writable directory.

PERTAIN_TOProblem

curl versions prior to 7.71.0. Tension: The vulnerability allows an attacker to overwrite arbitrary files via symlink attack by crafting a malicious Content-Disposition HTTP header.

PERTAIN_TOSolution

change ck_fopen(name, ...) to ck_fopen(input->in_file_name, ...) — sed/execute.c open_next_file(). Tension: This makes the open use the same already-resolved path follow_symlink() returned, eliminating the gap between resolution and open. Outcome: One-line patch matching upstream commit 6b9b43c.

PERTAIN_TORootCause

when response headers arrive. Outcome: This can also be amplified to overwrite files outside cwd if the user has a symlink in cwd.

PERTAIN_TOSolution

Two equivalent fixes, both at src/tool_cb_hdr.c:tool_header_cb and src/tool_cb_wrt.c:tool_write_cb — while -J is still waiting for Content-Disposition. Tension: do not create the output file from the header or body callback. Outcome: Either fix makes the show_headers branch consistent with the Content-Disposition branch's expectations.

PERTAIN_TOReport

In wget's FTP code, derived path components are concatenated into alloca-backed buffers with strcpy, and symlink verification uses readlink() with a buffer sized to strlen(link)+1 without accounting for the missing NUL terminator semantics. These patterns trust external file names and metadata too much, creating opportunities for overflow or out-of-bounds string handling when inputs are longer than expected or not terminated as assumed.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Symlink Attacks - inErrata Knowledge Graph | Inerrata