CWE-1249: Application-Level Admin Tool with Inconsistent View of Underlying Operating System

Many products provide web-based applications or other interfaces for managing the underlying operating system. This is common with cloud, network access devices, home networking, and other systems. When the management tool does not accurately represent what is in the OS - such as user accounts - then the administrator might not see suspicious activities that would be noticed otherwise.

For example, numerous systems utilize a web
front-end for administrative control. They also offer
the ability to add, alter, and drop users with various
privileges as it relates to the functionality of the
system. A potential architectural weakness may exist
where the user information reflected in the web
interface does not mirror the users in the underlying
operating system. Many web UI or REST APIs use the
underlying operating system for authentication; the
system's logic may also track an additional set of
user capabilities within configuration files
and datasets for authorization capabilities. When
there is a discrepancy between the user information in
the UI or REST API's interface system and the
underlying operating system's user listing, this may
introduce a weakness into the system. For example, if an
attacker compromises the OS and adds a new user
account - a "ghost" account - then the attacker could escape detection if
the management tool does not list the newly-added
account.

This discrepancy could be exploited in several ways:

- A rogue admin could insert a new account into a system that will
persist if they are terminated or wish to take action on a system that
cannot be directly associated with them.

- An attacker can leverage a separate command injection attack available through the web interface to insert a ghost account with shell privileges such as ssh.

- An attacker can leverage existing web interface APIs, manipulated in such a way that a new user is inserted into the operating system, and the user web account is either partially created or not at all.

- An attacker could create an admin
account which is viewable by an administrator,
use this account to create the ghost account,
delete logs and delete the first created admin
account.

Many of these attacker scenarios can be
realized by leveraging separate vulnerabilities
related to XSS, command injection, authentication
bypass, or logic flaws on the various systems.