What is Improper Handling of Apple HFS+ Alternate (CWE-72)?

TL;DR: Improper Handling of Apple HFS+ Alternate Data Stream Path (CWE-72) occurs when the product does not properly handle special paths in the HFS+ file system, leading to read files or directories and modify files or directories.

What is Improper Handling of Apple HFS+ Alternate Data Stream Path?

Improper Handling of Apple HFS+ Alternate Data Stream Path (CWE-72) is a type of vulnerability that occurs when the product does not properly handle special paths in the HFS+ file system. As defined by the MITRE Corporation under CWE-72, and classified by the OWASP Foundation as none, this vulnerability can lead to read files or directories and modify files or directories.

Quick Summary

Improper Handling of Apple HFS+ Alternate Data Stream Path (CWE-72) is a type of vulnerability that occurs when the product does not properly handle special paths in the HFS+ file system. This can lead to confidentiality and integrity issues, compromising sensitive data. To prevent this vulnerability, it is essential to use proper input validation and error handling.

Jump to: Quick Summary · Improper Handling of Apple HFS+ Alternate Data Stream Path Overview · How Improper Handling of Apple HFS+ Alternate Data Stream Path Works · Business Impact of Improper Handling of Apple HFS+ Alternate Data Stream Path · Improper Handling of Apple HFS+ Alternate Data Stream Path Attack Scenario · How to Detect Improper Handling of Apple HFS+ Alternate Data Stream Path · How to Fix Improper Handling of Apple HFS+ Alternate Data Stream Path · Framework-Specific Fixes for Improper Handling of Apple HFS+ Alternate Data Stream Path · How to Ask AI to Check Your Code for Improper Handling of Apple HFS+ Alternate Data Stream Path · Improper Handling of Apple HFS+ Alternate Data Stream Path Best Practices Checklist · Improper Handling of Apple HFS+ Alternate Data Stream Path FAQ · Vulnerabilities Related to Improper Handling of Apple HFS+ Alternate Data Stream Path · References · Scan Your Own Site

Improper Handling of Apple HFS+ Alternate Data Stream Path Overview

What

Improper Handling of Apple HFS+ Alternate Data Stream Path (CWE-72) occurs when the product does not properly handle special paths in the HFS+ file system.

Why it matters

This vulnerability can lead to read files or directories and modify files or directories, compromising confidentiality and integrity.

Where it occurs

This vulnerability typically occurs on Apple devices running macOS or iOS.

Who is affected

Developers and users of Apple devices are affected by this vulnerability.

Who is NOT affected

Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Improper Handling of Apple HFS+ Alternate Data Stream Path Works

Root Cause

The root cause of this vulnerability is the product’s inability to properly handle special paths in the HFS+ file system.

Attack Flow

1. The attacker constructs a malicious path that identifies the data or resource fork of a file on the HFS+ file system.
2. The product fails to properly handle the special path, allowing the attacker to read files or directories and modify files or directories.

Prerequisites to Exploit

• The product must be running on an Apple device (macOS or iOS).
• The attacker must have access to the HFS+ file system.

Vulnerable Code

import os

def save_uploaded_file(filename, content):
    dest = os.path.join(UPLOAD_DIR, filename)
    with open(dest, 'wb') as f:
        f.write(content)

filename is taken directly from the upload request. On an HFS+ volume, a name using the named-fork syntax (e.g. report.txt/..namedfork/rsrc) doesn’t get rejected — it writes into the resource fork of an existing (or newly created) report.txt instead of a distinct file, letting an attacker smuggle content that checks scanning only the data fork of files matching known names will never see.

Secure Code

import os

def save_uploaded_file(filename, content):
    if '..namedfork' in filename or '/' in filename:
        raise ValueError('invalid filename')
    dest = os.path.join(UPLOAD_DIR, filename)
    with open(dest, 'wb') as f:
        f.write(content)

Rejecting the named-fork path segment (and any / inside what should be a bare filename) before it reaches the filesystem API closes off the alternate-stream syntax entirely, so the write can only ever land in a file’s regular data fork.

Business Impact of Improper Handling of Apple HFS+ Alternate Data Stream Path

Confidentiality

• Sensitive data may be exposed due to read files or directories.
• Confidential information may be compromised.

Integrity

• Files or directories may be modified, compromising integrity.

Availability

• The product may become unavailable due to the vulnerability.

Improper Handling of Apple HFS+ Alternate Data Stream Path Attack Scenario

1. An attacker constructs a malicious path that identifies the data or resource fork of a file on the HFS+ file system.
2. The product fails to properly handle the special path, allowing the attacker to read files or directories and modify files or directories.

How to Detect Improper Handling of Apple HFS+ Alternate Data Stream Path

Manual Testing

• Review the product’s code for proper handling of special paths in the HFS+ file system.
• Test the product with malicious input to identify vulnerabilities.

Automated Scanners (SAST / DAST)

• Use automated scanners to identify potential vulnerabilities in the product’s code.

PenScan Detection

• PenScan’s scanner engines actively test for this issue.

False Positive Guidance

• Be cautious of false positives when using automated scanners, as they may flag legitimate code as vulnerable.

How to Fix Improper Handling of Apple HFS+ Alternate Data Stream Path

• Properly handle special paths in the HFS+ file system through input validation and error handling.
• Use secure coding practices to prevent vulnerabilities.

Framework-Specific Fixes for Improper Handling of Apple HFS+ Alternate Data Stream Path

Java

import java.io.File;

File baseDir = new File("/Users/user/Documents/");
String path = "../file.txt";

if (!path.startsWith(baseDir.getAbsolutePath())) {
    throw new SecurityException("Invalid path");
} else {
    // Proceed with secure code
}

Node.js

const fs = require('fs');

const baseDir = '/Users/user/Documents/';
const path = '../file.txt';

if (!path.startsWith(baseDir)) {
  throw new Error('Invalid path');
} else {
  // Proceed with secure code
}

Python/Django

import os

base_dir = '/Users/user/Documents/'
path = '../file.txt'

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')
else:
    # Proceed with secure code

PHP

$baseDir = '/Users/user/Documents/';
$path = '../file.txt';

if (!strpos($path, $baseDir) === 0) {
    throw new Exception('Invalid path');
} else {
    // Proceed with secure code
}

How to Ask AI to Check Your Code for Improper Handling of Apple HFS+ Alternate Data Stream Path

You can review your code using an AI coding assistant and rewrite it using proper handling of special paths in the HFS+ file system.

Improper Handling of Apple HFS+ Alternate Data Stream Path Best Practices Checklist

✅ Always properly handle special paths in the HFS+ file system through input validation and error handling. ✅ Use secure coding practices to prevent vulnerabilities. ✅ Review your code regularly for potential vulnerabilities.

Improper Handling of Apple HFS+ Alternate Data Stream Path FAQ

How does Improper Handling of Apple HFS+ Alternate Data Stream Path occur?

Improper Handling of Apple HFS+ Alternate Data Stream Path (CWE-72) occurs when the product does not properly handle special paths in the HFS+ file system.

What are the common consequences of Improper Handling of Apple HFS+ Alternate Data Stream Path?

The common consequences include read files or directories and modify files or directories.

How can I detect Improper Handling of Apple HFS+ Alternate Data Stream Path in my application?

You can use manual testing, automated scanners (SAST / DAST), and PenScan detection to identify this vulnerability.

What is the primary fix for Improper Handling of Apple HFS+ Alternate Data Stream Path?

The primary fix involves proper handling of special paths in the HFS+ file system.

How can I prevent Improper Handling of Apple HFS+ Alternate Data Stream Path in my application?

You can use best practices such as input validation and proper error handling to prevent this vulnerability.

What are some common frameworks that are affected by Improper Handling of Apple HFS+ Alternate Data Stream Path?

This weakness is generic enough to occur in any backend language, so we will provide examples for Java, Node.js, Python/Django, and PHP.

How can I use AI to check my code for Improper Handling of Apple HFS+ Alternate Data Stream Path?

You can review your code using an AI coding assistant and rewrite it using proper handling of special paths in the HFS+ file system.

Vulnerabilities Related to Improper Handling of Apple HFS+ Alternate Data Stream Path

References

• MITRE: https://cwe.mitre.org/data/definitions/72.html
• NVD: https://nvd.nist.gov/

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Handling of Apple HFS+ Alternate Data Stream Path and other risks before an attacker does.