1429
• account for known weaknesses in the design/implementation of the API
• call the API from a safe context
If the caller of the API does not follow these requirements, then it may allow a malicious user or
process to elevate their privilege, hijack the process, or steal sensitive data.
For instance, it is important to know if privileged APIs do not shed their privileges before returning
to the caller or if the privileged function might make certain assumptions about the data, context or
state information passed to it by the caller. It is important to always know when and how privileged
APIs can be called in order to ensure that their elevated level of privilege cannot be exploited.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 269 Improper Privilege Management 646
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 265 Privilege Issues 2316
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
An attacker may be able to elevate privileges.
Confidentiality Read Application Data
An attacker may be able to obtain sensitive information.
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
An attacker may be able to execute code.
Potential Mitigations
Phase: Implementation
Before calling privileged APIs, always ensure that the assumptions made by the privileged code
hold true prior to making the call.
Phase: Architecture and Design
Know architecture and implementation weaknesses of the privileged APIs and make sure to
account for these weaknesses before calling the privileged APIs to ensure that they can be
called safely.
Phase: Implementation
If privileged APIs make certain assumptions about data, context or state validity that are passed
by the caller, the calling code must ensure that these assumptions have been validated prior to
making the call.
CWE Version 4.14
CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity
Checking
CWE-649: Reliance on Obfuscation or Encryption of
Security-Relevant Inputs without Integrity Checking 1430
Phase: Implementation
If privileged APIs do not shed their privilege prior to returning to the calling code, then calling
code needs to shed these privileges immediately and safely right after the call to the privileged
APIs. In particular, the calling code needs to ensure that a privileged thread of execution will
never be returned to the user or made available to user-controlled processes.
Phase: Implementation
Only call privileged APIs from safe, consistent and expected state.
Phase: Implementation
Ensure that a failure or an error will not leave a system in a state where privileges are not
properly shed and privilege escalation is possible (i.e. fail securely with regards to handling of
privileges).
Observed Examples
Reference Description
CVE-2003-0645 A Unix utility that displays online help files, if installed setuid, could allow a
local attacker to gain privileges when a particular file-opening function is called.
https://www.cve.org/CVERecord?id=CVE-2003-0645
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 977 SFP Secondary Cluster: Design 888 2407
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
107 Cross Site Tracing
234 Hijacking a privileged process
CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs
without Integrity Checking
Weakness ID : 649
Structure : Simple
Abstraction : Base
Description
The product uses obfuscation or encryption of inputs that should not be mutable by an external
actor, but the product does not use integrity checks to detect if those inputs have been modified.
Extended Description
When an application relies on obfuscation or incorrectly applied / weak encryption to protect clientcontrollable
tokens or parameters, that may have an effect on the user state, system state, or
some decision made on the server. Without protecting the tokens/parameters for integrity, the
application is vulnerable to an attack where an adversary traverses the space of possible values
of the said token/parameter in order to attempt to gain an advantage. The goal of the attacker is
to find another admissible value that will somehow elevate their privileges in the system, disclose
information or change the behavior of the system in some way beneficial to the attacker. If the
CWE Version 4.14
CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity
Checking
CWE-649: Reliance on Obfuscation or Encryption of
Security-Relevant Inputs without Integrity Checking