What is Improper Handling of Windows Device Names (CWE-67)?

TL;DR: Improper Handling of Windows Device Names (CWE-67) occurs when a product constructs pathnames from user input but fails to handle or incorrectly handles a pathname containing a Windows device name, leading to denial of service and information exposure.

At-a-Glance

What is Improper Handling of Windows Device Names?

Improper Handling of Windows Device Names (CWE-67) is a type of vulnerability that occurs when a product constructs pathnames from user input but fails to handle or incorrectly handles a pathname containing a Windows device name. As defined by the MITRE Corporation under CWE-67, and classified by the OWASP Foundation under None, this vulnerability can lead to denial of service and information exposure.

Quick Summary

Improper Handling of Windows Device Names (CWE-67) is a critical issue for developers to address due to its potential to cause denial of service and information exposure. This vulnerability occurs when a product constructs pathnames from user input but fails to handle or incorrectly handles a pathname containing a Windows device name.

Jump to: Quick Summary · Improper Handling of Windows Device Names Overview · How Improper Handling of Windows Device Names Works · Business Impact of Improper Handling of Windows Device Names · Improper Handling of Windows Device Names Attack Scenario · How to Detect Improper Handling of Windows Device Names · How to Fix Improper Handling of Windows Device Names · Framework-Specific Fixes for Improper Handling of Windows Device Names · How to Ask AI to Check Your Code for Improper Handling of Windows Device Names · Improper Handling of Windows Device Names Best Practices Checklist · Improper Handling of Windows Device Names FAQ · Vulnerabilities Related to Improper Handling of Windows Device Names · References

Improper Handling of Windows Device Names Overview

What: Improper Handling of Windows Device Names (CWE-67) is a type of vulnerability that occurs when a product constructs pathnames from user input but fails to handle or incorrectly handles a pathname containing a Windows device name.

Why it matters: This vulnerability can lead to denial of service and information exposure, making it a critical issue for developers to address.

Where it occurs: Improper Handling of Windows Device Names (CWE-67) typically occurs in products that construct pathnames from user input, such as web applications or file systems.

Who is affected: Any product that constructs pathnames from user input and fails to handle or incorrectly handles a pathname containing a Windows device name can be affected by this vulnerability.

Who is NOT affected: Products that do not construct pathnames from user input are not affected by this vulnerability, such as applications that never construct paths/queries/commands from external input.

How Improper Handling of Windows Device Names Works

Root Cause

The root cause of Improper Handling of Windows Device Names (CWE-67) is the failure to handle or incorrectly handling a pathname containing a Windows device name when constructing pathnames from user input.

Attack Flow

1. An attacker provides a pathname containing a Windows device name as input to a product that constructs pathnames from user input.
2. The product fails to handle or incorrectly handles the pathname, leading to denial of service and information exposure.

Prerequisites to Exploit

• The product must construct pathnames from user input.
• The product must fail to handle or incorrectly handle a pathname containing a Windows device name.

Vulnerable Code

#include <stdio.h>

void create_user_file(const char *filename) {
    FILE *f = fopen(filename, "w");
    if (f) {
        fclose(f);
    }
}

filename comes from the request as-is. On Windows, names like CON, COM1, or LPT1 aren’t ordinary filenames at all — the OS resolves them to reserved device objects, so fopen() on one of them doesn’t create a normal file; it can block indefinitely or behave unpredictably, letting an attacker tie up a worker thread and cause a denial of service by repeatedly requesting such a name.

Secure Code

#include <string.h>
#include <ctype.h>

static const char *RESERVED_NAMES[] = {
    "CON", "PRN", "AUX", "NUL",
    "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
    "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9"
};

int is_reserved_device_name(const char *filename) {
    char base[32];
    size_t i = 0;
    while (filename[i] && filename[i] != '.' && i < sizeof(base) - 1) {
        base[i] = toupper((unsigned char)filename[i]);
        i++;
    }
    base[i] = '\0';
    for (size_t j = 0; j < sizeof(RESERVED_NAMES) / sizeof(RESERVED_NAMES[0]); j++) {
        if (strcmp(base, RESERVED_NAMES[j]) == 0) {
            return 1;
        }
    }
    return 0;
}

void create_user_file(const char *filename) {
    if (is_reserved_device_name(filename)) {
        return; /* reject: reserved device name */
    }
    FILE *f = fopen(filename, "w");
    if (f) {
        fclose(f);
    }
}

Checking the filename’s base name (before any extension) against the real list of reserved Windows device names, case-insensitively, rejects the request before it ever reaches fopen().

Business Impact of Improper Handling of Windows Device Names

Improper Handling of Windows Device Names (CWE-67) can lead to denial of service and information exposure, resulting in significant financial losses, compliance issues, and reputational damage. The business impacts include:

• Confidentiality: Information exposure can occur when an attacker gains access to sensitive data stored on a device.
• Integrity: Denial of service can occur when an attacker causes a system or application to become unavailable.
• Availability: Denial of service can also occur when an attacker causes a system or application to become unavailable.

Improper Handling of Windows Device Names Attack Scenario

1. An attacker provides a pathname containing a Windows device name as input to a product that constructs pathnames from user input.
2. The product fails to handle or incorrectly handles the pathname, leading to denial of service and information exposure.
3. The attacker gains access to sensitive data stored on the device.

How to Detect Improper Handling of Windows Device Names

Manual Testing

• Provide a pathname containing a Windows device name as input to the product.
• Observe if the product fails to handle or incorrectly handles the pathname, leading to denial of service and information exposure.

Automated Scanners (SAST / DAST)

• Use automated scanners to detect Improper Handling of Windows Device Names in your code.
• Note that static analysis may not catch all instances of this vulnerability, as some may require dynamic testing to detect.

PenScan Detection

• Use PenScan’s automated scan engines to detect Improper Handling of Windows Device Names in your website.
• PenScan’s scanners can identify potential vulnerabilities and provide recommendations for improvement.

False Positive Guidance

• Be aware that false positives may occur when a pattern looks risky but is actually safe due to context a scanner cannot see.
• Use manual testing or additional analysis to verify the presence of this vulnerability.

How to Fix Improper Handling of Windows Device Names

• Familiarize yourself with device names in your operating system and check input for these device names.
• Implement checks to ensure that pathnames containing device names are handled correctly.

Framework-Specific Fixes for Improper Handling of Windows Device Names

C

#include <stdio.h>
#include <stdlib.h>

int main() {
    char *input = "CON";
    if (access(input, F_OK) == 0) {
        chdir(input);
    } else {
        printf("Invalid directory path\n");
        return 1;
    }
    return 0;
}

Node.js

const fs = require('fs');

function checkPathname(pathname) {
    if (pathname.includes('\\')) {
        console.log('Invalid pathname');
        return false;
    } else {
        return true;
    }
}

console.log(checkPathname('CON'));

How to Ask AI to Check Your Code for Improper Handling of Windows Device Names

You can use the following prompt with an AI coding assistant: “Review the following C code block for potential CWE-67 Improper Handling of Windows Device Names vulnerabilities and rewrite it using checks to ensure that pathnames containing device names are handled correctly: [paste code here]”

Improper Handling of Windows Device Names Best Practices Checklist

✅ Familiarize yourself with device names in your operating system. ✅ Check input for these device names. ✅ Implement checks to ensure that pathnames containing device names are handled correctly.

Improper Handling of Windows Device Names FAQ

How does Improper Handling of Windows Device Names occur?

Improper Handling of Windows Device Names occurs when a product constructs pathnames from user input but fails to handle or incorrectly handles a pathname containing a Windows device name.

What are the consequences of Improper Handling of Windows Device Names?

The consequences of Improper Handling of Windows Device Names include denial of service and information exposure.

How can I detect Improper Handling of Windows Device Names in my code?

You can detect Improper Handling of Windows Device Names using manual testing, automated scanners, or PenScan’s detection capabilities.

What is the best way to prevent Improper Handling of Windows Device Names?

The best way to prevent Improper Handling of Windows Device Names is to be familiar with device names in your operating system and check input for these device names.

Can AI help me identify and fix Improper Handling of Windows Device Names in my code?

Yes, AI can help you identify and fix Improper Handling of Windows Device Names by reviewing your code and providing recommendations for improvement.

What are some best practices to follow when handling device names in your code?

Some best practices to follow include being familiar with device names in your operating system and checking input for these device names.

How can I use PenScan’s automated scan engines to detect Improper Handling of Windows Device Names in my website?

You can use PenScan’s automated scan engines by scanning your website using the “Improper Handling of Windows Device Names” test.

Vulnerabilities Related to Improper Handling of Windows Device Names

References

• MITRE: CWE-67
• NVD: None

Scan Your Own Site

PenScan’s automated scan engines actively test for this issue.