CWE-732: Incorrect Permission Assignment for Critical Resource

Description

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.

Potential Impact

Demonstrative Examples

#define OUTFILE "hello.out"
                     umask(0);FILE *out;
                     /* Ignore link following (CWE-59) for brevity */
                     
                     out = fopen(OUTFILE, "w");if (out) {fprintf(out, "hello world!\n");fclose(out);}

-rw-rw-rw- 1 username 13 Nov 24 17:58 hello.out

function createUserDir($username){$path = '/home/'.$username;if(!mkdir($path)){return false;}if(!chown($path,$username)){rmdir($path);return false;}return true;}

$fileName = "secretFile.out";
                     if (-e $fileName) {chmod 0777, $fileName;}
                     my $outFH;if (! open($outFH, ">>$fileName")) {ExitError("Couldn't append to $fileName: $!");}my $dateString = FormatCurrentTime();my $status = IsHostAlive("cwe.mitre.org");print $outFH "$dateString cwe status: $status!\n";close($outFH);

-rw-r--r-- 1 username 13 Nov 24 17:58 secretFile.out

-rw-rw-rw- 1 username 13 Nov 24 17:58 secretFile.out

const adminFile = "/etc/admin-users"
                  func createAdminFileIfNotExists() error {
                     
                        file, err := os.Create(adminFile)
                        if err != nil {
                        
                           return err
                        
                        }
                        return nil
                  }
                  
                  
                  func changeModeOfAdminFile() error {
                     
                        fileMode := os.FileMode(0440)
                        if err := os.Chmod(adminFile, fileMode); err != nil {
                        
                           return err
                        
                        }
                        return nil
                  }

Mitigations & Prevention

Detection Methods

• Automated Static Analysis — Automated static analysis may be effective in detecting permission problems for system resources such as files, directories, shared memory, device interfaces, etc. Automated techniques may be able to detect the use of library functions that modify permissions, then analyze function calls for argumen
• Automated Dynamic Analysis — Automated dynamic analysis may be effective in detecting permission problems for system resources such as files, directories, shared memory, device interfaces, etc. However, since the software's intended security policy might allow loose permissions for certain operations (such a
• Manual Analysis — This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
• Manual Static Analysis — Manual static analysis may be effective in detecting the use of custom permissions models and functions. The code could then be examined to identifying usage of the related functions. Then the human analyst could evaluate permission assignments in the context of the intended security model of the so
• Manual Dynamic Analysis — Manual dynamic analysis may be effective in detecting the use of custom permissions models and functions. The program could then be executed with a focus on exercising code paths that are related to the custom permissions. Then the human analyst could evaluate permission assignments in the context o
• Fuzzing — Fuzzing is not effective in detecting this weakness.

Real-World CVE Examples

Showing 15 of 19 observed examples.

Related Weaknesses

Taxonomy Mappings

• The CERT Oracle Secure Coding Standard for Java (2011): FIO03-J — Create files with appropriate access permission
• The CERT Oracle Secure Coding Standard for Java (2011): SEC01-J — Do not allow tainted variables in privileged blocks
• The CERT Oracle Secure Coding Standard for Java (2011): ENV03-J — Do not grant dangerous combinations of permissions
• CERT C Secure Coding: FIO06-C — Create files with appropriate access permissions