VNX-427: Uncontrolled Search Path Element

Reports C/C++ code that loads a library or program through a search path an attacker can influence: LoadLibrary/LoadLibraryEx of a bare DLL name without a restricted search, dlopen of a relative path, and PATH/LD_LIBRARY_PATH/LD_PRELOAD/DYLD_* set to an empty or relative element or from argv.

Field	Value
Rule ID	`VNX-427`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	C, C++
CWE	CWE-427
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`search-path-element` `dll-planting` `cwe-427`
Source	`internal/sast/rules/vnx-427.rego`

Overview

VNX-427 maps to CWE-427: Uncontrolled Search Path Element. A library or program is looked up through a search path that contains a directory someone else controls, typically the current working directory or the application directory, so a planted file of the right name is loaded instead of the real one.

What Gets Flagged

LoadLibrary/LoadLibraryA/LoadLibraryW with a bare DLL name (no directory), unless it is a KnownDLL such as kernel32 or the file calls SetDefaultDllDirectories.
LoadLibraryEx with a bare name and no LOAD_LIBRARY_SEARCH_*, LOAD_LIBRARY_AS_DATAFILE or LOAD_LIBRARY_AS_IMAGE_RESOURCE flag.
dlopen() of a relative path containing a slash ("./plugins/libauth.so"), which resolves against the current directory.
setenv/putenv/SetEnvironmentVariable of PATH, LD_LIBRARY_PATH, LD_PRELOAD, LD_AUDIT or DYLD_* to a literal with an empty element ("::", a leading or trailing separator) or a relative element, or to a value taken from argv/optarg.

HMODULE h = LoadLibraryA("cryptext.dll");                 // FLAGGED
void *p = dlopen("./plugins/libauth.so", RTLD_NOW);        // FLAGGED
setenv("LD_LIBRARY_PATH", "lib:/usr/lib", 1);              // FLAGGED
setenv("PATH", argv[2], 1);                                // FLAGGED

LoadLibraryExW(L"cryptext.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);  // not flagged
dlopen("libssl.so.3", RTLD_NOW);                                      // not flagged

Not reported: absolute paths, KnownDLLs, a bare soname for dlopen, a library name held in a variable (that is VNX-114), other environment variables, comments and strings. Running a command by relative name through system() is CWE-426 and not reported here.

Remediation

Load DLLs by full path, or with LoadLibraryEx(name, NULL, LOAD_LIBRARY_SEARCH_SYSTEM32); call SetDefaultDllDirectories at start-up.
Build dlopen paths from the executable’s own location, never from the working directory.
Use only absolute directories in search-path variables, and never take them from the command line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-427
// nosec vnx-427

Or record an ignore rule: vulnetix ignore add --rule vnx-427 --reason "...". See Suppressing findings.