648
Very carefully manage the setting, management, and handling of privileges. Explicitly manage
trust zones in the software.
Phase: Architecture and Design
Strategy = Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software
system.
Phase: Architecture and Design
Strategy = Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met
before permitting access to a system resource.
Demonstrative Examples
Example 1:
This code temporarily raises the program's privileges to allow creation of a new user folder.
Example Language: Python (Bad)
def makeNewUserDir(username):
if invalidUsername(username):
#avoid CWE-22 and CWE-78
print('Usernames cannot contain invalid characters')
return False
try:
raisePrivileges()
os.mkdir('/home/' + username)
lowerPrivileges()
except OSError:
print('Unable to create new user directory for user:' + username)
return False
return True
While the program only raises its privilege level to create the folder and immediately lowers it again,
if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result,
the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation
to occur.
Example 2:
The following example demonstrates the weakness.
Example Language: C (Bad)
seteuid(0);
/* do some stuff */
seteuid(getuid());
Example 3:
The following example demonstrates the weakness.
Example Language: Java (Bad)
AccessController.doPrivileged(new PrivilegedAction() {
public Object run() {
// privileged code goes here, for example:
System.loadLibrary("awt");
return null;
// nothing to return
}
CWE Version 4.14
CWE-269: Improper Privilege Management
CWE-269: Improper Privilege Management