1558
Example Language: Shell (Bad)
chmod -R ugo+r DIRNAME
If this command is run from a program, the person calling the program might not expect that all the
files under the directory will be world-readable. If the directory is expected to contain private data,
this could become a security problem.
Example 6:
The following Azure command updates the settings for a storage account:
Example Language: Shell (Bad)
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access true
However, "Allow Blob Public Access" is set to true, meaning that anonymous/public users can
access blobs.
The command could be modified to disable "Allow Blob Public Access" by setting it to false.
Example Language: Shell (Good)
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access false
Example 7:
The following Google Cloud Storage command gets the settings for a storage account named
'BUCKET_NAME':
Example Language: Shell (Informative)
gsutil iam get gs://BUCKET_NAME
Suppose the command returns the following result:
Example Language: JSON (Bad)
{
"bindings":[{
"members":[
"projectEditor: PROJECT-ID",
"projectOwner: PROJECT-ID"
],
"role":"roles/storage.legacyBucketOwner"
},
{
"members":[
"allUsers",
"projectViewer: PROJECT-ID"
],
"role":"roles/storage.legacyBucketReader"
}
]
}
This result includes the "allUsers" or IAM role added as members, causing this policy configuration
to allow public access to cloud storage resources. There would be a similar concern if
"allAuthenticatedUsers" was present.
The command could be modified to remove "allUsers" and/or "allAuthenticatedUsers" as follows:
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource