661
Nature Type ID Name Page
PeerOf 252 Unchecked Return Value 606
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 754 Improper Check for Unusual or Exceptional Conditions 1568
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 265 Privilege Issues 2316
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Background Details
In Windows based environments that have access control, impersonation is used so that access
checks can be performed on a client identity by a server with higher privileges. By impersonating
the client, the server is restricted to client-level security -- although in different threads it may have
much higher privileges.
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
If privileges are not dropped, neither are access rights of
the user. Often these rights can be prevented from being
dropped.
Access Control
Non-Repudiation
Gain Privileges or Assume Identity
Hide Activities
If privileges are not dropped, in some cases the
system may record actions as the user which is being
impersonated rather than the impersonator.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
CWE Version 4.14
CWE-273: Improper Check for Dropped Privileges
CWE-273: Improper Check for Dropped Privileges