CWE-269: Improper Privilege Management

Privilege management covers the full lifecycle of access rights: determining what should be granted, assigning rights, changing or revoking them, maintaining their state, propagating security context, and checking authorization before sensitive operations. The weakness occurs when one of these activities is performed incorrectly, such as failing to reset privileges at session termination, computing a role or status incorrectly, or passing an unsuitable privileged context to a child process.

As a result, an actor may control resources, operations, or identities beyond the intended boundary. Problems involving operating-system privileges, setuid, user groups, capabilities, or internal access rights can all express this weakness, although some examples also depend on a separate contributing weakness.

This weakness can arise during architecture and design, during implementation of a security tactic, or during operation. It includes granting incorrect rights, failing to revoke or reset rights, tracking privilege state inaccurately, propagating the wrong security context, or performing incomplete authorization checks. It is not language-specific and can give a user, process, object, or other actor more control than intended.

The primary consequence is an access-control failure in which an actor can gain privileges or assume an identity. The resulting unintended control may extend to protected resources, privileged operations, or security-sensitive entities, depending on which privilege was assigned, retained, propagated, or checked incorrectly.

Privilege governance: Carefully manage how privileges are set, administered, and handled throughout the product, and explicitly define and manage trust zones in the software.

Least privilege: During architecture and design, assign each entity only the access rights it requires.

Separation of privilege: Where appropriate, require multiple independent conditions to be satisfied before allowing access to a system resource.

Automated static analysis, commonly called Static Application Security Testing (SAST), can identify some instances by analyzing source code or binary or compiled code without executing it. It typically builds data-flow and control-flow models and searches for potentially vulnerable patterns connecting sources, where input originates, to sinks, where data interacts with external components or a lower layer such as the operating system. This approach has limited coverage and does not guarantee detection of every instance of improper privilege management.

The following are representative examples from the official record, not an exhaustive list:

• CVE-2001-1555: Terminal privileges are not reset when a user logs out.
• CVE-2001-1514: In certain cases, the security context is not properly passed to child processes, allowing privilege escalation.
• CVE-2001-0128: Roles are computed incorrectly.
• CVE-1999-1193: An untrusted user is placed in the Unix wheel group.
• CVE-2005-2741: Users can grant themselves certain rights that can be used to escalate privileges.
• CVE-2005-2496: The product uses a user's group ID instead of the group, causing it to run with different privileges; this results from another unknown issue.
• CVE-2004-0274: The product mistakenly assigns a status to an entity, leading to increased privileges.
• CVE-2007-4217: An FTP client runs with setuid privileges and has a buffer overflow. Clients that do not need extra privileges would not become vulnerable from the overflow for that reason alone.
• CVE-2007-5159: The operating system incorrectly installs a program with setuid privileges, allowing users to gain privileges.
• CVE-2008-4638: An application running with high privileges allows a user to specify a restricted file for processing, and a parsing error leaks the file contents.
• CVE-2007-3931: An installation script installs some programs as setuid when they should not be.
• CVE-2002-1981: Roles have access to dangerous procedures.
• CVE-2002-1671: An untrusted object or method gets access to the clipboard.
• CVE-2000-0315: The traceroute program allows unprivileged users to modify a packet's source address.
• CVE-2000-0506: A user with a capability can prevent a setuid program from dropping privileges.