2051
systems. When the management tool does not accurately represent what is in the OS - such as
user accounts - then the administrator might not see suspicious activities that would be noticed
otherwise.
For example, numerous systems utilize a web front-end for administrative control. They also offer
the ability to add, alter, and drop users with various privileges as it relates to the functionality of
the system. A potential architectural weakness may exist where the user information reflected in
the web interface does not mirror the users in the underlying operating system. Many web UI or
REST APIs use the underlying operating system for authentication; the system's logic may also
track an additional set of user capabilities within configuration files and datasets for authorization
capabilities. When there is a discrepancy between the user information in the UI or REST API's
interface system and the underlying operating system's user listing, this may introduce a weakness
into the system. For example, if an attacker compromises the OS and adds a new user account - a
"ghost" account - then the attacker could escape detection if the management tool does not list the
newly-added account.
This discrepancy could be exploited in several ways:
• A rogue admin could insert a new account into a system that will persist if they are terminated
or wish to take action on a system that cannot be directly associated with them.
• An attacker can leverage a separate command injection attack available through the web
interface to insert a ghost account with shell privileges such as ssh.
• An attacker can leverage existing web interface APIs, manipulated in such a way that a new
user is inserted into the operating system, and the user web account is either partially created
or not at all.
• An attacker could create an admin account which is viewable by an administrator, use this
account to create the ghost account, delete logs and delete the first created admin account.
Many of these attacker scenarios can be realized by leveraging separate vulnerabilities related to
XSS, command injection, authentication bypass, or logic flaws on the various systems.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1250 Improper Preservation of Consistency Between Independent
Representations of Shared State