1556
FILE *out;
/* Ignore link following (CWE-59) for brevity */
out = fopen(OUTFILE, "w");
if (out) {
fprintf(out, "hello world!\n");
fclose(out);
}
After running this program on a UNIX system, running the "ls -l" command might return the
following output:
Example Language: (Result)
-rw-rw-rw- 1 username 13 Nov 24 17:58 hello.out
The "rw-rw-rw-" string indicates that the owner, group, and world (all users) can read the file and
write to it.
Example 2:
This code creates a home directory for a new user, and makes that user the owner of the directory.
If the new directory cannot be owned by the user, the directory is deleted.
Example Language: PHP (Bad)
function createUserDir($username){
$path = '/home/'.$username;
if(!mkdir($path)){
return false;
}
if(!chown($path,$username)){
rmdir($path);
return false;
}
return true;
}
Because the optional "mode" argument is omitted from the call to mkdir(), the directory is created
with the default permissions 0777. Simply setting the new user as the owner of the directory does
not explicitly change the permissions of the directory, leaving it with the default. This default allows
any user to read and write to the directory, allowing an attack on the user's files. The code also fails
to change the owner group of the directory, which may result in access by unexpected groups.
This code may also be vulnerable to Path Traversal (CWE-22) attacks if an attacker supplies a non
alphanumeric username.
Example 3:
The following code snippet might be used as a monitor to periodically record whether a web site is
alive. To ensure that the file can always be modified, the code uses chmod() to make the file worldwritable.
Example Language: Perl (Bad)
$fileName = "secretFile.out";
if (-e $fileName) {
chmod 0777, $fileName;
}
my $outFH;
if (! open($outFH, ">>$fileName")) {
ExitError("Couldn't append to $fileName: $!");
}
my $dateString = FormatCurrentTime();
my $status = IsHostAlive("cwe.mitre.org");
print $outFH "$dateString cwe status: $status!\n";
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource