1553
(such as publishing a file on a web server), automated dynamic analysis may produce some
false positives - i.e., warnings that do not have any security consequences or require any code
changes. When custom permissions models are used - such as defining who can read messages
in a particular forum in a bulletin board system - these can be difficult to detect using automated
dynamic analysis. It may be possible to define custom signatures that identify any custom
functions that implement the permission checks and assignments.
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human)
analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester
to record and modify an active session.
Manual Static Analysis
Manual static analysis may be effective in detecting the use of custom permissions models and
functions. The code could then be examined to identifying usage of the related functions. Then
the human analyst could evaluate permission assignments in the context of the intended security
model of the software.
Manual Dynamic Analysis
Manual dynamic analysis may be effective in detecting the use of custom permissions models
and functions. The program could then be executed with a focus on exercising code paths that
are related to the custom permissions. Then the human analyst could evaluate permission
assignments in the context of the intended security model of the software.
Fuzzing
Fuzzing is not effective in detecting this weakness.
Black Box
Use monitoring tools that examine the software's process as it interacts with the operating
system and the network. This technique is useful in cases when source code is unavailable, if the
software was not developed by you, or if you want to verify that the build phase did not introduce
any new weaknesses. Examples include debuggers that directly attach to the running process;
system-call tracing utilities such as truss (Solaris) and strace (Linux); system activity monitors
such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities (Windows); and
sniffers and protocol analyzers that monitor network traffic. Attach the monitor to the process and
watch for library functions or system calls on OS resources such as files, directories, and shared
memory. Examine the arguments to these calls to infer which permissions are being used.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Inter-application Flow Analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that
audit mechanisms work, ensure host configuration meets certain predefined criteria Web
Application Scanner Web Services Scanner Database Scanners
Effectiveness = SOAR Partial
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource