Weakness (CWE)
CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
How to prevent it (8 mitigations)
-
Implementation
When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]
-
Architecture and Design, Operation
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Implementation, Installation
During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
-
System Configuration
For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
-
Documentation
Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
-
Installation
Do not assume that a system administrator will manually change the configuration to the settings that are recommended in the software's manual.
-
Operation, System Configuration
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
Source: MITRE CWE-732
989 results · Feed
-
Medium 6.5
Apache Archiva Arbitrary user password reset vulnerability
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
-
Critical 9.9
Authorization Bypass Through User-Controlled Key in publify/publify
Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.
-
High 7.8
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.…
-
Medium 4.9
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…
-
Critical 9.8
Incorrect Permission Assignment for Critical Resource in ShopXO
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php.
-
High 7.3
Privilege Escalation in Miele Benchmark Programming Tool
In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binar…
-
Unscored —
On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX In…
-
High 8.1
Improper Access Control in shopware
Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1…
-
Medium 6.0
ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform
The affected product is vulnerable to misconfigured binaries, allowing users on the target PC with SYSTEM level privileges access to overwrite the binary and modify files to gain privilege escalation.
-
High 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due …
KEV Apr 15, 2022 -
Unscored —
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Mana…
-
High 8.8
Incorrect Permission Assignment for Critical Resource in zerotier/zerotierone
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
-
Medium 6.4
Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admi…
-
High 7.8
CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
-
Medium 4.3
Missing permission check in Jenkins JiraTestResultReporter Plugin
A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
High 8.8
SaltStack Salt Permissions Bypass
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectl…
-
Medium 5.9
Default inheritable capabilities for linux container should be empty
Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilit…
-
Medium 5.3
suddoers configuration for cscreen not restrictive enough
A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion…
-
Unscored —
'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper AC…
-
Unscored —
'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pip…
-
High 7.6
NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unp…
-
High 7.8
Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)
Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate…
-
Unscored —
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one…
-
High 7.5
Write access to VMO data through copy-on-write in Fuchsia
An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5…
-
Unscored —
A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created Serv…
-
Critical 9.1
Remote code execution for scripted UDFs
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host.…
-
Medium 4.2
Incorrect Permission Assignment for Critical Resource in CRI-O
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel n…
-
High 8.4
SECURITY - OPC Server for AC 800M - Remote Code Execution Vulnerability
Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server.
-
Medium 6.5
Incorrect Permission Assignment for Critical Resource in microweber/microweber
Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
-
Low 3.7
OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resour…
-
Medium 4.3
Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin
A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 4.3
Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin
Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a …
-
Medium 4.3
Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin
A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
-
Medium 6.8
Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users
It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.
-
High 8.8
Sunnet eHRD - Broken Access Control
Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt …
-
Critical 9.1
HashiCorp Vault Incorrect Permission Assignment for Critical Resource
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy…
-
Unscored —
Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.
-
High 7.8
Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability
Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges unde…
-
Medium 6.5
Access mode of block tokens are not enforced
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
-
Unscored —
A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns imprope…