xmlwf Symlink Following Vulnerability in libexpat

Executive Summary

This vulnerability is a symlink following issue in the xmlwf tool of libexpat through version 2.10.0. When using the -d output mode, xmlwf opens files with fopen('wb'), which follows symbolic links. Local attackers with write access to the output directory can create a symlink at the expected output filename to truncate or overwrite files writable by the xmlwf user.

Useful 0 Not Useful 0

Detection Guidance

Check if xmlwf is installed and its version. Run 'xmlwf -v' to see the version. If it is version 2.10.0 or earlier, the system is vulnerable. Also, review file permissions in directories where xmlwf writes output to detect suspicious symlinks.

Useful 0 Not Useful 0

Impact Analysis

If you use xmlwf with the -d option on a system where an attacker has write access to the output directory, they could overwrite or truncate files that the xmlwf process has permission to modify. This could lead to data loss or corruption for files owned by the xmlwf user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by potentially allowing unauthorized file modifications, which may violate integrity requirements in GDPR or HIPAA. If sensitive files are overwritten, it could lead to data breaches or loss of audit integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade libexpat to version 2.11.0 or later. Avoid using the -d output mode in xmlwf until patched. Restrict write access to directories where xmlwf outputs files to prevent symlink creation.

Useful 0 Not Useful 0