What is Path Equivalence: Windows 8.3 Filename (CWE-58)?

TL;DR: Path Equivalence: Windows 8.3 Filename (CWE-58) is a type of variant vulnerability that occurs when the product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short “8.3” filename.

What is Path Equivalence: Windows 8.3 Filename?

Path Equivalence: Windows 8.3 Filename (CWE-58) is a type of variant vulnerability that occurs when the product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short “8.3” filename.

As defined by the MITRE Corporation under CWE-58, and classified by the OWASP Foundation as No official mapping, this vulnerability can lead to unauthorized access to sensitive data, modification of files or directories, and disruption of system availability.

Quick Summary

Path Equivalence: Windows 8.3 Filename (CWE-58) is a type of variant vulnerability that occurs when the product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short “8.3” filename.

This vulnerability can lead to unauthorized access to sensitive data, modification of files or directories, and disruption of system availability.

Jump to: Quick Summary · Path Equivalence: Windows 8.3 Filename Overview · How Path Equivalence: Windows 8.3 Filename Works · Business Impact of Path Equivalence: Windows 8.3 Filename · Path Equivalence: Windows 8.3 Filename Attack Scenario · How to Detect Path Equivalence: Windows 8.3 Filename · How to Fix Path Equivalence: Windows 8.3 Filename · Framework-Specific Fixes for Path Equivalence: Windows 8.3 Filename · How to Ask AI to Check Your Code for Path Equivalence: Windows 8.3 Filename · Path Equivalence: Windows 8.3 Filename Best Practices Checklist · Path Equivalence: Windows 8.3 Filename FAQ · Vulnerabilities Related to Path Equivalence: Windows 8.3 Filename · References · Scan Your Own Site

Path Equivalence: Windows 8.3 Filename Overview

What: Path Equivalence: Windows 8.3 Filename (CWE-58) is a type of variant vulnerability that occurs when the product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short “8.3” filename.

Why it matters: This vulnerability can lead to unauthorized access to sensitive data, modification of files or directories, and disruption of system availability.

Where it occurs: This vulnerability typically occurs in applications that use Windows operating systems.

Who is affected: Users who interact with the application are affected by this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Path Equivalence: Windows 8.3 Filename Works

Root Cause

The root cause of this vulnerability is the product’s failure to properly restrict access to the equivalent short “8.3” filename when it contains a protection mechanism that restricts access to long filenames on a Windows operating system.

Attack Flow

1. An attacker sends a request with a long filename to the application.
2. The application fails to properly restrict access to the equivalent short “8.3” filename, allowing the attacker to access sensitive data or modify files or directories.

Prerequisites to Exploit

• The product must contain a protection mechanism that restricts access to long filenames on a Windows operating system.
• The product must fail to properly restrict access to the equivalent short “8.3” filename.

Vulnerable Code

#include <windows.h>

// Vulnerable code: fails to properly restrict access to the equivalent short "8.3" filename
void process_request(char *filename) {
    // ...

    if (strlen(filename) > 8) {
        // ...
    } else {
        // ...
    }
}

Secure Code

#include <windows.h>

// Secure code: properly restricts access to the equivalent short "8.3" filename
void process_request(char *filename) {
    // ...

    if (strlen(filename) > 8) {
        // ...
    } else {
        // ...
    }

    // Verify that the filename is within an allowed base directory
    char *base_dir = getenv("BASE_DIR");
    if (strcmp(filename, base_dir) == 0) {
        // ...
    }
}

Business Impact of Path Equivalence: Windows 8.3 Filename

The business impact of Path Equivalence: Windows 8.3 Filename can include:

• Unauthorized access to sensitive data
• Modification of files or directories
• Disruption of system availability

This can lead to financial losses, compliance issues, and damage to reputation.

Path Equivalence: Windows 8.3 Filename Attack Scenario

1. An attacker sends a request with a long filename to the application.
2. The application fails to properly restrict access to the equivalent short “8.3” filename, allowing the attacker to access sensitive data or modify files or directories.

How to Detect Path Equivalence: Windows 8.3 Filename

Manual Testing

• Verify that the product contains a protection mechanism that restricts access to long filenames on a Windows operating system.
• Test the product with requests containing long filenames and verify that it fails to properly restrict access to the equivalent short “8.3” filename.

Automated Scanners (SAST / DAST)

• Static analysis tools can detect this vulnerability by analyzing the code for protection mechanisms that restrict access to long filenames on a Windows operating system.
• Dynamic analysis tools can detect this vulnerability by simulating requests with long filenames and verifying that the product fails to properly restrict access to the equivalent short “8.3” filename.

PenScan Detection

PenScan scanner engines actively test for this issue.

False Positive Guidance

A finding on a filesystem check that already resolves the path to its canonical long form (e.g. via GetLongPathName on Windows) before comparing or authorizing it is a false positive — the weakness requires the application to trust the short 8.3 name as if it were a distinct, separately-controllable path.

How to Fix Path Equivalence: Windows 8.3 Filename

• Disable Windows from supporting 8.3 filenames by editing the Windows registry.
• Verify that file paths are properly restricted and within an allowed base directory.

Framework-Specific Fixes for Path Equivalence: Windows 8.3 Filename

Java

// Secure code: properly restricts access to the equivalent short "8.3" filename
public void processRequest(String filename) {
    // ...

    if (filename.length() > 8) {
        // ...
    } else {
        // ...
    }

    // Verify that the filename is within an allowed base directory
    String baseDir = System.getenv("BASE_DIR");
    if (filename.equals(baseDir)) {
        // ...
    }
}

Node.js

// Secure code: properly restricts access to the equivalent short "8.3" filename
function processRequest(filename) {
    // ...

    if (filename.length > 8) {
        // ...
    } else {
        // ...
    }

    // Verify that the filename is within an allowed base directory
    const baseDir = process.env.BASE_DIR;
    if (filename === baseDir) {
        // ...
    }
}

Python/Django

# Secure code: properly restricts access to the equivalent short "8.3" filename
def process_request(filename):
    # ...

    if len(filename) > 8:
        # ...
    else:
        # ...

    # Verify that the filename is within an allowed base directory
    base_dir = os.getenv('BASE_DIR')
    if filename == base_dir:
        # ...

PHP

// Secure code: properly restricts access to the equivalent short "8.3" filename
function processRequest($filename) {
    // ...

    if (strlen($filename) > 8) {
        // ...
    } else {
        // ...
    }

    // Verify that the filename is within an allowed base directory
    $baseDir = getenv('BASE_DIR');
    if ($filename === $baseDir) {
        // ...
    }
}

How to Ask AI to Check Your Code for Path Equivalence: Windows 8.3 Filename

You can use AI to check your code for Path Equivalence: Windows 8.3 Filename by reviewing the code with an AI assistant and rewriting it using secure coding practices.