CWEweakness

CWE-69 Improper Handling of Windows ::DATA Alternate Data Stream

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Common consequences

• Access Control, Non-Repudiation, Other: Bypass Protection Mechanism, Hide Activities, Other — An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Potential mitigations

• [Implementation] Ensure that the source code correctly parses the filename to read or write to the correct stream.

Detection methods

• Automated Analysis: Software tools are capable of finding ADSs on your system.

Observed examples

• CVE-1999-0278: In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. • CVE-2000-0927: Product does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions.

Related

Attack pattern · CAPEC (1)

  • CAPEC-168 Windows ::DATA Alternate Data Stream attack pattern

Observed example · CVE (2)

  • CVE-2000-0927 WQuinn QuotaAdvisor 4.1 does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass… vulnerability
  • CVE-1999-0278 In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. vulnerability

Child of · CWE (1)

  • CWE-66 Improper Handling of File Names that Identify Virtual Resources weakness

Referenced by CAPEC · weakness (1)

  • CAPEC-168 Windows ::DATA Alternate Data Stream attack pattern

Referenced by CVE · weakness (3)

  • CVE-2026-52792 Algernon is a small self-contained pure-Go web server. vulnerability
  • CVE-2025-3941 Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise… vulnerability
  • CVE-2024-43033 JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to… vulnerability