642
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive
information that may include administrative functionality
and user accounts.
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage
trust zones in the software.
Phase: Architecture and Design
Phase: Operation
Strategy = Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks
[REF-76]. If possible, create isolated accounts with limited privileges that are only used for a
single task. That way, a successful attack will not immediately give the attacker access to the
rest of the software or its environment. For example, database applications rarely need to run as
the database administrator, especially in day-to-day operations.
Demonstrative Examples
Example 1:
This code intends to allow only Administrators to print debug information about a system.
Example Language: Java (Bad)
public enum Roles {
ADMIN,USER,GUEST
}
public void printDebugInfo(User requestingUser){
if(isAuthenticated(requestingUser)){
switch(requestingUser.role){
case GUEST:
System.out.println("You are not authorized to perform this command");
break;
default:
System.out.println(currentDebugState());
break;
}
}
else{
System.out.println("You must be logged in to perform this command");
}
}
While the intention was to only allow Administrators to print the debug information, the code as
written only excludes those with the role of "GUEST". Someone with the role of "ADMIN" or "USER"
will be allowed access, which goes against the original intent. An attacker may be able to use this
debug information to craft an attack on the system.
Observed Examples
Reference Description
CVE-2002-1981 Roles have access to dangerous procedures (Accessible entities).
https://www.cve.org/CVERecord?id=CVE-2002-1981
CVE-2002-1671 Untrusted object/method gets access to clipboard (Accessible entities).
https://www.cve.org/CVERecord?id=CVE-2002-1671
CWE Version 4.14
CWE-267: Privilege Defined With Unsafe Actions
CWE-267: Privilege Defined With Unsafe Actions