602
Perform extensive input validation for any privileged code that must be exposed to the user and
reject anything that does not fit your strict requirements.
Phase: Implementation
When dropping privileges, ensure that they have been dropped successfully to avoid CWE-273.
As protection mechanisms in the environment get stronger, privilege-dropping calls may fail even
if it seems like they would always succeed.
Phase: Implementation
If circumstances force you to run with extra privileges, then determine the minimum access
level necessary. First identify the different permissions that the software and its users will need
to perform their actions, such as file read and write permissions, network socket permissions,
and so forth. Then explicitly allow those actions while denying all else [REF-76]. Perform
extensive input validation and canonicalization to minimize the chances of introducing a separate
vulnerability. This mitigation is much more prone to error than dropping the privileges in the first
place.
Phase: Operation
Phase: System Configuration
Strategy = Environment Hardening
Ensure that the software runs properly under the United States Government Configuration
Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many
organizations use to limit the attack surface and potential risk of deployed software.
Demonstrative Examples
Example 1:
This code temporarily raises the program's privileges to allow creation of a new user folder.
Example Language: Python (Bad)
def makeNewUserDir(username):
if invalidUsername(username):
#avoid CWE-22 and CWE-78
print('Usernames cannot contain invalid characters')
return False
try:
raisePrivileges()
os.mkdir('/home/' + username)
lowerPrivileges()
except OSError:
print('Unable to create new user directory for user:' + username)
return False
return True
While the program only raises its privilege level to create the folder and immediately lowers it again,
if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result,
the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation
to occur.
Example 2:
The following code calls chroot() to restrict the application to a subset of the filesystem below
APP_HOME in order to prevent an attacker from using the program to gain unauthorized access
to files located elsewhere. The code then opens a file specified by the user and processes the
contents of the file.
Example Language: C (Bad)
chroot(APP_HOME);
chdir("/");
CWE Version 4.14
CWE-250: Execution with Unnecessary Privileges
CWE-250: Execution with Unnecessary Privileges