1267
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Phase: System Configuration
Phase: Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use
the provider's controls to disable public access.
Demonstrative Examples
Example 1:
The following Azure command updates the settings for a storage account:
Example Language: Shell (Bad)
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access true
However, "Allow Blob Public Access" is set to true, meaning that anonymous/public users can
access blobs.
The command could be modified to disable "Allow Blob Public Access" by setting it to false.
Example Language: Shell (Good)
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access false
Example 2:
The following Google Cloud Storage command gets the settings for a storage account named
'BUCKET_NAME':
Example Language: Shell (Informative)
gsutil iam get gs://BUCKET_NAME
Suppose the command returns the following result:
Example Language: JSON (Bad)
{
"bindings":[{
"members":[
"projectEditor: PROJECT-ID",
"projectOwner: PROJECT-ID"
],
"role":"roles/storage.legacyBucketOwner"
},
{
"members":[
"allUsers",
"projectViewer: PROJECT-ID"
],
"role":"roles/storage.legacyBucketReader"
}
CWE Version 4.14
CWE-552: Files or Directories Accessible to External Parties
CWE-552: Files or Directories Accessible to External Parties