Weakness (CWE)
CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
How to prevent it (8 mitigations)
-
Implementation
When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]
-
Architecture and Design, Operation
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Implementation, Installation
During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
-
System Configuration
For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
-
Documentation
Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
-
Installation
Do not assume that a system administrator will manually change the configuration to the settings that are recommended in the software's manual.
-
Operation, System Configuration
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
Source: MITRE CWE-732
989 results · Feed
-
Medium 6.5
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device no…
-
Medium 4.3
Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group wr…
-
Medium 4.3
Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticat…
-
Medium 4.3
Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group …
-
Medium 4.3
Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group wr…
-
Medium 4.3
Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group writ…
-
Low 3.3
Nextcloud Talk Android broadcast incorrect permission handling
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk An…
-
High 7.8
OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. T…
-
Medium 5.9
CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privi…
-
Low 3.7
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authenti…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iO…
-
High 7.8
The Automox Agent before 40 on Windows incorrectly sets permissions on key files.
-
High 7.3
Junos OS Evolved: Incorrect file permissions can allow low-privileged user to cause another user to execute arbitrary commands
An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user to modify the contents of a configuration file which could cause another user to execute arbitrary commands within the…
-
Low 2.6
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to s…
-
High 8.8
If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update…
-
Medium 4.3
bytebase - Improper Authorization
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
-
Medium 4.3
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents …
-
High 8.5
Bifrost users using basic authntication can bypass write permission limit
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only h…
-
Medium 4.3
A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any aut…
-
High 8.8
Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation…
-
High 8.8
Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaSc…
-
Critical 9.8
In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege e…
-
High 7.1
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set acc…
-
Medium 6.2
Honeywell SoftMaster Incorrect Permission Assignment for Critical Resource
A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.
-
High 7.2
Talos worker join token can be used to get elevated access level to the Talos API
Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos con…
-
High 8.8
Apache ShenYu Admin Improper Privilege Management
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.
-
High 7.5
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f…
-
High 7.5
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f…
-
Unscored —
A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source …
-
Medium 6.5
Gitea allowed assignment of private issues
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker…
-
Medium 4.3
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Brows…
-
High 8.8
Ovarro TBox Incorrect Permission Assignment for Critical Resource
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
-
Medium 6.5
Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.
-
Unscored —
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon sessio…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Paralle…
-
Medium 5.1
Use of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows unauthorized access to the ser…
-
Unscored —
It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with wo…
-
Medium 6.5
ABB Relion REX640 Insufficient file access control
Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.
-
High 7.8
A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designe…
-
Medium 6.5
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel exe…