1268
]
}
This result includes the "allUsers" or IAM role added as members, causing this policy configuration
to allow public access to cloud storage resources. There would be a similar concern if
"allAuthenticatedUsers" was present.
The command could be modified to remove "allUsers" and/or "allAuthenticatedUsers" as follows:
Example Language: Shell (Good)
gsutil iam ch -d allUsers gs://BUCKET_NAME
gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME
Observed Examples
Reference Description
CVE-2005-1835 Data file under web root.
https://www.cve.org/CVERecord?id=CVE-2005-1835
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 815 OWASP Top Ten 2010 Category A6 - Security
Misconfiguration
809 2358
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
OWASP Top Ten 2004 A10 CWE More Specific Insecure Configuration Management
CERT C Secure Coding FIO15-C Ensure that file operations are
performed in a secure directory
Related Attack Patterns
CAPEC-ID Attack Pattern Name
150 Collect Data from Common Resource Locations
639 Probe System Files
References
[REF-1307]Center for Internet Security. "CIS Microsoft Azure Foundations Benchmark version
1.5.0". 2022 August 6. < https://www.cisecurity.org/benchmark/azure >.2023-01-19.
CWE Version 4.14
CWE-553: Command Shell in Externally Accessible Directory
CWE-553: Command Shell in Externally Accessible Directory