CWE-283: Unverified Ownership

Description

The product does not properly verify that a critical resource is owned by the proper entity.

Potential Impact

Access Control

Gain Privileges or Assume Identity

Demonstrative Examples

This function is part of a privileged program that takes input from users with potentially lower privileges.

Bad

def killProcess(processID):os.kill(processID, signal.SIGKILL)

This code does not confirm that the process to be killed is owned by the requesting user, thus allowing an attacker to kill arbitrary processes.

This function remedies the problem by checking the owner of the process before killing it:

Good

def killProcess(processID):
                        user = getCurrentUser()
                           
                           #Check process owner against requesting user
                           if getProcessOwner(processID) == user:os.kill(processID, signal.SIGKILL)return
                           else:print("You cannot kill a process you don't own")return

Mitigations & Prevention

Architecture and DesignOperation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Real-World CVE Examples

CVE ID	Description
CVE-2001-0178	Program does not verify the owner of a UNIX socket that is used for sending a password.
CVE-2004-2012	Owner of special device not checked, allowing root.

Taxonomy Mappings

PLOVER: — Unverified Ownership

Frequently Asked Questions

What is CWE-283?

CWE-283 (Unverified Ownership) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not properly verify that a critical resource is owned by the proper entity.

How can CWE-283 be exploited?

Attackers can exploit CWE-283 (Unverified Ownership) to gain privileges or assume identity. This weakness is typically introduced during the Architecture and Design phase of software development.

How do I prevent CWE-283?

Key mitigations include: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

What is the severity of CWE-283?

CWE-283 is classified as a Base-level weakness (Medium abstraction). It has been observed in 2 real-world CVEs.