Improper Handling of Windows Device Names
CWE-67
The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
We track 2 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8.
How this weakness is prevented
- Implementation: Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.
Latest Improper Handling of Windows Device Names vulnerabilities
- 7.5 High severity
PHP: Improper Handling of Windows Device Names
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW
- 10.0 Critical severity
wasmtime: Improper Handling of Windows Device Names
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device fi