What is Windows Hard Link (CWE-65)?

TL;DR: Windows Hard Link (CWE-65) is a type of access control vulnerability that occurs when an application fails to handle hard links correctly, potentially allowing unauthorized files to be accessed or modified.

What is Windows Hard Link?

Windows Hard Link (CWE-65) is a type of access control vulnerability that occurs when an application fails to handle hard links correctly, potentially allowing unauthorized files to be accessed or modified.

As defined by the MITRE Corporation under CWE-65, and classified by the OWASP Foundation under A01:2025 - Broken Access Control, Windows Hard Link is a vulnerability that can lead to data breaches and other security issues if not properly addressed.

Quick Summary

Windows Hard Link (CWE-65) is a type of access control vulnerability that occurs when an application fails to handle hard links correctly. This vulnerability can lead to unauthorized file access and modification, which can result in data breaches and other security issues. To prevent this vulnerability, it’s essential to follow the principle of least privilege when assigning access rights to entities in your software system and ensure good compartmentalization in the system.

Jump to: Quick Summary · Windows Hard Link Overview · How Windows Hard Link Works · Business Impact of Windows Hard Link · Windows Hard Link Attack Scenario · How to Detect Windows Hard Link · How to Fix Windows Hard Link · Framework-Specific Fixes for Windows Hard Link · How to Ask AI to Check Your Code for Windows Hard Link · Windows Hard Link Best Practices Checklist · Windows Hard Link FAQ · Vulnerabilities Related to Windows Hard Link · References · Scan Your Own Site

Windows Hard Link Overview

What: Windows Hard Link (CWE-65) is a type of access control vulnerability that occurs when an application fails to handle hard links correctly.

Why it matters: This vulnerability can lead to unauthorized file access and modification, which can result in data breaches and other security issues.

Where it occurs: This vulnerability typically occurs on Windows systems where applications fail to properly handle hard links.

Who is affected: Any user or system that relies on the vulnerable application may be affected by this vulnerability.

Who is NOT affected: Systems that do not use the vulnerable application are not affected by this vulnerability.

How Windows Hard Link Works

Root Cause

The root cause of a Windows Hard Link vulnerability is an application’s failure to properly handle hard links. This can occur when an application fails to verify the integrity of hard links or allows unauthorized users to create or modify hard links.

Attack Flow

1. An attacker creates a hard link to a sensitive file.
2. The vulnerable application accesses the hard link, which grants the attacker access to the sensitive file.
3. The attacker can then read, write, or delete the sensitive file.

Prerequisites to Exploit

• The vulnerable application must be running on a Windows system.
• The attacker must have the ability to create and manage hard links on the system.

Vulnerable Code

#include <windows.h>

void reset_permissions(const char *filename) {
    char path[MAX_PATH];
    snprintf(path, MAX_PATH, "C:\\App\\uploads\\%s", filename);
    SetFileAttributesA(path, FILE_ATTRIBUTE_NORMAL);
}

filename names a file inside a directory shared with less-trusted users. Because a hard link shares the same underlying file record as its target, an attacker can pre-create a hard link at that filename pointing at a file they don’t own elsewhere on the same NTFS volume; this code changes attributes on whatever the name currently resolves to with no check that it’s still the upload it expects.

Secure Code

#include <windows.h>

int is_hard_linked(const char *path) {
    HANDLE hFile = CreateFileA(path, GENERIC_READ, FILE_SHARE_READ, NULL,
                                OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
    if (hFile == INVALID_HANDLE_VALUE) return 0;
    BY_HANDLE_FILE_INFORMATION info;
    int linked = 0;
    if (GetFileInformationByHandle(hFile, &info)) {
        linked = info.nNumberOfLinks > 1;
    }
    CloseHandle(hFile);
    return linked;
}

void reset_permissions(const char *filename) {
    char path[MAX_PATH];
    snprintf(path, MAX_PATH, "C:\\App\\uploads\\%s", filename);
    if (is_hard_linked(path)) {
        return; /* refuse: hard-linked file */
    }
    SetFileAttributesA(path, FILE_ATTRIBUTE_NORMAL);
}

BY_HANDLE_FILE_INFORMATION.nNumberOfLinks is the real Windows equivalent of Unix’s st_nlink — checking it before the operation catches a hard-linked file that a simple existence or attribute check would silently miss.

Business Impact of Windows Hard Link

Confidentiality: Unauthorized access to sensitive files can lead to data breaches and other security issues.

Integrity: Modification or deletion of sensitive files can result in financial losses, compliance issues, and reputational damage.

Availability: Disruption of services due to unauthorized file access or modification can result in downtime and lost productivity.

Windows Hard Link Attack Scenario

1. An attacker creates a hard link to a sensitive file.
2. The vulnerable application accesses the hard link, which grants the attacker access to the sensitive file.
3. The attacker reads, writes, or deletes the sensitive file.

How to Detect Windows Hard Link

Manual Testing

• Review your code for potential CWE-65 Windows Hard Link vulnerabilities.
• Use a debugger to step through your code and identify any hard link-related issues.
• Test your application with various inputs to ensure it handles hard links correctly.

Automated Scanners (SAST/DAST)

• Use automated scanners that check for hard link vulnerabilities in your code.
• These scanners can help you detect potential CWE-65 Windows Hard Link vulnerabilities before they become a problem.

PenScan Detection

PenScan’s automated scanning engines actively test for this issue.

False Positive Guidance

Be cautious when interpreting scanner results, as some false positives may occur due to legitimate hard links. Always review your code and context before making any changes.

How to Fix Windows Hard Link

• Follow the principle of least privilege when assigning access rights to entities in your software system.
• Ensure good compartmentalization in the system to provide protected areas that can be trusted.
• Use secure coding practices, such as proper verification of hard link integrity and attributes.

Framework-Specific Fixes for Windows Hard Link

Java

// Create a hard link to a sensitive file with proper verification
File file = new File("C:\\Sensitive\\file.txt");
if (file.exists()) {
    // Verify the integrity of the hard link
    if (file.canRead() && file.canWrite()) {
        // Set the hard link's attributes with proper verification
        file.setReadable(true);
        file.setWritable(true);
    }
}

Node.js

// Create a hard link to a sensitive file with proper verification
const fs = require('fs');
const file = fs.createReadStream("C:\\Sensitive\\file.txt");
if (file.exists()) {
    // Verify the integrity of the hard link
    if (file.canRead() && file.canWrite()) {
        // Set the hard link's attributes with proper verification
        file.setReadable(true);
        file.setWritable(true);
    }
}

Python/Django

# Create a hard link to a sensitive file with proper verification
import os
from django.core.files import File

file = open("C:\\Sensitive\\file.txt", "r")
if os.path.exists(file.name):
    # Verify the integrity of the hard link
    if file.can_read() and file.can_write():
        # Set the hard link's attributes with proper verification
        file.set_readable(True)
        file.set_writable(True)

PHP

// Create a hard link to a sensitive file with proper verification
$filePath = "C:\\Sensitive\\file.txt";
if (file_exists($filePath)) {
    // Verify the integrity of the hard link
    if (is_readable($filePath) && is_writable($filePath)) {
        // Set the hard link's attributes with proper verification
        chmod($filePath, 0644);
    }
}

How to Ask AI to Check Your Code for Windows Hard Link

You can ask an AI coding assistant to review your code for potential CWE-65 Windows Hard Link vulnerabilities and rewrite it using secure practices.

Windows Hard Link Best Practices Checklist

✅ Always follow the principle of least privilege when assigning access rights to entities in your software system.

✅ Ensure good compartmentalization in the system to provide protected areas that can be trusted.

✅ Use secure coding practices, such as proper verification of hard link integrity and attributes.

Windows Hard Link FAQ

How does Windows Hard Link work?

Windows Hard Link (CWE-65) is a vulnerability that occurs when an application fails to handle hard links correctly, potentially allowing unauthorized files to be accessed or modified.

What are the consequences of a Windows Hard Link attack?

The consequences of a Windows Hard Link attack can include unauthorized file access and modification, which can lead to data breaches and other security issues.

How do I detect Windows Hard Link in my code?

You can detect Windows Hard Link by using manual testing or automated scanners (SAST/DAST) that check for hard link vulnerabilities.

What is the best way to fix a Windows Hard Link vulnerability?

The best way to fix a Windows Hard Link vulnerability is to follow the principle of least privilege when assigning access rights to entities in your software system and ensure good compartmentalization in the system to provide protected areas that can be trusted.

Can AI help me detect and prevent Windows Hard Link vulnerabilities?

Yes, AI-powered coding assistants can help you review your code for potential CWE-65 Windows Hard Link vulnerabilities and rewrite it using secure practices.

What are some best practices to prevent Windows Hard Link vulnerabilities?

Some best practices to prevent Windows Hard Link vulnerabilities include following the principle of least privilege when assigning access rights, ensuring good compartmentalization in the system, and using secure coding practices.

Are there any related CWEs or CAPEC IDs for Windows Hard Link?

Yes, CWE-65 is a more specific variant of CWE-59 (Improper Link Resolution Before File Access), which is a parent weakness.

Vulnerabilities Related to Windows Hard Link

References

• https://cwe.mitre.org/data/definitions/65.html (MITRE)
• https://owasp.org/Top10/A01_2025-Broken_Access_Control/ (OWASP)
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Windows Hard Link and other risks before an attacker does.