1. Home
  2. CWE Database
  3. CWE-428
Base · Medium

CWE-428: Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

CWE-428 · Base Level ·3 CVEs ·3 Mitigations

Description

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.

Potential Impact

Confidentiality, Integrity, Availability

Execute Unauthorized Code or Commands

Demonstrative Examples

The following example demonstrates the weakness.
Bad
UINT errCode = WinExec( "C:\\Program Files\\Foo\\Bar", SW_SHOW );

Mitigations & Prevention

Implementation

Properly quote the full search path before executing a program on the system.

Implementation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across relat

Implementation

Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Real-World CVE Examples

CVE IDDescription
CVE-2005-1185Small handful of others. Program doesn't quote the "C:\Program Files\" path when calling a program to be executed - or any other path with a directory or file whose name contains a space - so attacker
CVE-2005-2938CreateProcess() and CreateProcessAsUser() can be misused by applications to allow "program.exe" style attacks in C:
CVE-2000-1128Applies to "Common Files" folder, with a malicious common.exe, instead of "Program Files"/program.exe.

CWE-668: Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the...

Taxonomy Mappings

  • PLOVER: — Unquoted Search Path or Element

Frequently Asked Questions

What is CWE-428?

CWE-428 (Unquoted Search Path or Element) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

How can CWE-428 be exploited?

Attackers can exploit CWE-428 (Unquoted Search Path or Element) to execute unauthorized code or commands. This weakness is typically introduced during the Implementation phase of software development.

How do I prevent CWE-428?

Key mitigations include: Properly quote the full search path before executing a program on the system.

What is the severity of CWE-428?

CWE-428 is classified as a Base-level weakness (Medium abstraction). It has been observed in 3 real-world CVEs.