Incorrect Default Permissions [CWE-276]

Incorrect Default Permissions weakness describes a case where software sets insecure permissions to objects on a system.

Created: October 31, 2012
Latest Update: December 28, 2020

Table of Content

1. Description
2. Potential impact
3. Attack patterns
4. Affected software
5. Exploitation Examples
6. Severity and CVSS Scoring
7. Mitigations
8. References
9. Latest Related Security Advisories

Want to have an in-depth understanding of all modern aspects of
Incorrect Default Permissions [CWE-276]? Read carefully this article and bookmark it to get back later, we regularly update this page.

1. Description

This weakness describes a case where software sets unintended permissions to directories, files or other objects during installation process. As a result, a malicious user might be able to bypass intended security restrictions.

Most modern operating systems support access control lists (ACL) that are used to distinguish access rights for different users and groups. In modern operating systems a principal (e.g. process or threat acting on behalf of a user) acts upon objects. Access to these objects (e.g. files, directories, registry keys, etc.) is crucial for security mechanisms implemented in different operating systems and can influence system behavior depending on permissions imposed upon key components of the operating system.

2. Potential impact

Usually this weakness is locally exploitable. A malicious user might be able to gain access to sensitive information, tamper with sensitive data or compromise the vulnerable system entirely. If a setuid/setgid executable has world writable permissions any local user can inject malicious content into it and execute arbitrary code with privileges of the file's owner.

Basically, any application writable by an unintended actor poses a threat to system security and might be used to elevate privileges on the system, e.g. if such application was modified by a malicious and unprivileged user before being executed by a privileged one.

3. Attack patterns

The following CAPEC patterns correspond to this weakness:

• CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
• CAPEC-19: Embedding Scripts within Scripts
• CAPEC-81: Web Logs Tampering
• CAPEC-127: Directory Indexing
• CAPEC-169: Footprinting

Incorrect permissions vulnerability is described in WASC Threat Classification as a weakness under WASC-17 (Improper Filesystem Permissions).

4. Affected software

Software that changes access rights to objects during installation is potentially vulnerable to this weakness.

5. Exploitation Examples

We will use the HTB23123 security advisory (CVE-2012-5697) as an example of this weakness. The vulnerability is introduced by the "btinstall" installation script that sets world-writable permissions for all files within the "/frameworkgui/" directory.

Let's login into the system under unprivileged guest account. To view files permissions we will execute the "ls –la" command, as demonstrated on the image below:

Now we will try to read the "config" file and then modify the agentpoll.pl script:

As a result of this vulnerability any local user has full access to files within the "/frameworkgui/" directory.

6. Severity and CVSS Scoring

Insecure default permissions are usually applied to locally installed applications, that's why the primary access vector is local system.

Information disclosure

In case of potential information disclosure (e.g. software configuration, credentials, etc.) this weakness should be scored as:
3.3 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N] - Low severity.

Data tampering

This weakness could be used to tamper with potentially sensitive information such as log files. If data can be modified or deleted, it should be scored as:
5.3 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L] - Medium severity.

System access

If an attacker can modify a setuid binary or any other file that can be executed by another user or service on the system, privilege escalation is possible. In this case this weakness should be scored as:
8.8 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H] - High severity.

7. Mitigations

Handling access rights is tricky, especially when software vendors are not doing it properly.

Linux- / UNIX-based systems

• Manage carefully user and group ownership for files and folders. Never let unintended groups access restricted information. Use /bin/ls command to view effective permissions for directories and files. Use chown and chgrp commands to set appropriate ownership rights.

• Avoid 777 permissions on files and folders, unless absolutely necessary, that all local users have read, write, and execute permissions to these files. Use chmod command to set appropriate permissions.

• Keep track of setuid / setgit executables.
  The following command lists all setuid and setgid files on the system:
  # find / -type f -perm /6000
To list all setuid and setgid files that are world writable execute the following command:
  # find . -type f -perm /6000 -a -perm -0002
If the above command lists files, this means a great threat for system security. It is recommended to change permissions for the listed files and perform full system audit. The system might be already compromised.

Windows-based systems

• Keep track of permissions installed by software for directories, files, and registry keys during installation.

• Never let applications set world writable permissions to executable files, especially within the system PATH environment variable or any other default search path, e.g. Windows, Windows/system32 directories, etc.

• Keep track of permissions for registry keys that are used to automatically launch applications during system startup, e.g. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, etc.

8. References

1. CWE-276: Incorrect Default Permissions [cwe.mitre.org]
2. Understanding Windows File And Registry Permissions [msdn.microsoft.com]
3. File Access Permissions [linuxfocus.org]
4. Configuring Unix / Linux File and Directory Access Rights [netsecurity.about.com]
5. Filesystem permissions [wikipedia.org]
6. Linux Files and File Permission [comptechdoc.org]

9. Incorrect Default Permissions Vulnerabilities, Exploits and Examples

• HTB23198: Multiple Vulnerabilities in Eventum
• HTB23123: Multiple Vulnerabilities in Smartphone Pentest Framework (SPF)

Copyright Disclaimer: Any above-mentioned content can be copied and used for non-commercial purposes only if proper credit to ImmuniWeb is given.