What is Privilege Defined With Unsafe Actions (CWE-267)?

TL;DR: Privilege Defined With Unsafe Actions (CWE-267) is a high-severity vulnerability that occurs when a particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it’s assigned to the correct entity. To fix this vulnerability, you can use environment hardening, running code with lowest required privileges, and creating isolated accounts with limited privileges.

At-a-Glance

What is Privilege Defined With Unsafe Actions?

Privilege Defined With Unsafe Actions (CWE-267) is a type of vulnerability that occurs when a particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it’s assigned to the correct entity. As defined by the MITRE Corporation under CWE-267, and classified by the OWASP Foundation as not directly mapped, this vulnerability can lead to unauthorized access to sensitive information and administrative functionality.

Quick Summary

Privilege Defined With Unsafe Actions (CWE-267) is a high-severity vulnerability that occurs when a particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it’s assigned to the correct entity. This vulnerability can lead to significant business impacts, including financial loss, compliance issues, and reputational damage.

Jump to: What is Privilege Defined With Unsafe Actions? · Quick Summary · Privilege Defined With Unsafe Actions Overview · How Privilege Defined With Unsafe Actions Works · Business Impact of Privilege Defined With Unsafe Actions · Privilege Defined With Unsafe Actions Attack Scenario · How to Detect Privilege Defined With Unsafe Actions · How to Fix Privilege Defined With Unsafe Actions · Framework-Specific Fixes for Privilege Defined With Unsafe Actions · How to Ask AI to Check Your Code for Privilege Defined With Unsafe Actions · Privilege Defined With Unsafe Actions Best Practices Checklist · Privilege Defined With Unsafe Actions FAQ · Vulnerabilities Related to Privilege Defined With Unsafe Actions · References · Scan Your Own Site

Privilege Defined With Unsafe Actions Overview

What: Privilege Defined With Unsafe Actions (CWE-267) occurs when a particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it’s assigned to the correct entity.

Why it matters: This vulnerability can lead to unauthorized access to sensitive information and administrative functionality, resulting in significant business impacts, including financial loss, compliance issues, and reputational damage.

Where it occurs: Privilege Defined With Unsafe Actions (CWE-267) can occur in any application that uses untrusted input.

Who is affected: Any user or entity with a particular privilege, role, capability, or right can be affected by this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Privilege Defined With Unsafe Actions Works

Root Cause

Privilege Defined With Unsafe Actions (CWE-267) occurs when a particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it’s assigned to the correct entity.

Attack Flow

1. An attacker gains access to an application with untrusted input.
2. The attacker uses the untrusted input to gain privileges or assume identity.
3. The attacker performs unsafe actions that were not intended, resulting in unauthorized access to sensitive information and administrative functionality.

Prerequisites to Exploit

• The application must use untrusted input.
• The attacker must have a particular privilege, role, capability, or right assigned to them.
• The application must not have proper validation and sanitization of user input.

Vulnerable Code

import os

# Untrusted input from user
input_path = request.form['path']

# Perform unsafe action with untrusted input
os.chdir(input_path)

This code demonstrates a vulnerable scenario where an attacker can use untrusted input to gain privileges or assume identity and perform unsafe actions.

Secure Code

import os

# Validate and sanitize user input
input_path = request.form['path']
if not os.path.abspath(input_path).startswith(base_dir):
    raise ValueError('Invalid path')

# Perform safe action with validated input
os.chdir(input_path)

This code demonstrates a secure scenario where the application validates and sanitizes user input before performing any actions.

Business Impact of Privilege Defined With Unsafe Actions

Confidentiality: Unauthorized access to sensitive information can lead to confidentiality breaches, resulting in financial loss and reputational damage.

Integrity: Unauthorized modification of data or system settings can lead to integrity breaches, resulting in compliance issues and reputational damage.

Availability: Denial-of-service attacks or unauthorized access to administrative functionality can lead to availability breaches, resulting in financial loss and reputational damage.

Privilege Defined With Unsafe Actions Attack Scenario

1. An attacker gains access to an application with untrusted input.
2. The attacker uses the untrusted input to gain privileges or assume identity.
3. The attacker performs unsafe actions that were not intended, resulting in unauthorized access to sensitive information and administrative functionality.

How to Detect Privilege Defined With Unsafe Actions

Manual Testing

• Review code for any instances of untrusted input being used to gain privileges or assume identity.
• Verify that all user input is properly validated and sanitized before performing any actions.
• Check if the application has proper validation and sanitization of user input.

Automated Scanners (SAST/DAST)

Automated scanners can catch instances of Privilege Defined With Unsafe Actions by analyzing code for patterns related to untrusted input being used to gain privileges or assume identity. However, dynamic analysis is required to detect this vulnerability, as static analysis may not be able to identify all instances.

PenScan Detection

PenScan’s scanner engines actively test for this issue and can detect Privilege Defined With Unsafe Actions in your code.

False Positive Guidance

To avoid false positives, ensure that any patterns detected by automated scanners are reviewed manually to verify their validity. Additionally, consider the context of the code being analyzed, as some instances may be safe due to additional validation or sanitization steps.

How to Fix Privilege Defined With Unsafe Actions

• Use environment hardening to restrict privileges and capabilities.
• Run code with lowest required privileges.
• Create isolated accounts with limited privileges.
• Properly validate and sanitize user input before performing any actions.

Framework-Specific Fixes for Privilege Defined With Unsafe Actions

Java

// Validate and sanitize user input
String inputPath = request.getParameter('path');
if (!inputPath.startsWith(baseDir)) {
    throw new ServletException("Invalid path");
}

// Perform safe action with validated input
File file = new File(inputPath);

Node.js

// Validate and sanitize user input
const inputPath = req.body.path;
if (!inputPath.startsWith(baseDir)) {
    return res.status(400).send('Invalid path');
}

// Perform safe action with validated input
const fs = require('fs');
const file = fs.readFileSync(inputPath);

Python/Django

# Validate and sanitize user input
input_path = request.POST['path']
if not input_path.startswith(base_dir):
    raise ValueError('Invalid path')

# Perform safe action with validated input
file = open(input_path, 'r')

How to Ask AI to Check Your Code for Privilege Defined With Unsafe Actions

Review the following Python code block for potential CWE-267 Privilege Defined With Unsafe Actions vulnerabilities and rewrite it using primary fix techniques:

import os

# Untrusted input from user
input_path = request.form['path']

# Perform unsafe action with untrusted input
os.chdir(input_path)

Rewrite this code to use environment hardening, run code with lowest required privileges, create isolated accounts with limited privileges, and properly validate and sanitize user input before performing any actions.

Privilege Defined With Unsafe Actions Best Practices Checklist

✅ Use environment hardening to restrict privileges and capabilities. ✅ Run code with lowest required privileges. ✅ Create isolated accounts with limited privileges. ✅ Properly validate and sanitize user input before performing any actions. ✅ Regularly review and update access controls to ensure they remain effective.

Privilege Defined With Unsafe Actions FAQ

How is Privilege Defined With Unsafe Actions different from other CWEs?

Privilege Defined With Unsafe Actions (CWE-267) occurs when a particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it’s assigned to the correct entity.

What are the common consequences of Privilege Defined With Unsafe Actions?

The common consequences of Privilege Defined With Unsafe Actions include gaining privileges or assuming identity, which can lead to unauthorized access to sensitive information and administrative functionality.

How do I detect Privilege Defined With Unsafe Actions in my code?

You can use manual testing, automated scanners (SAST/DAST), PenScan detection, and false positive guidance to detect Privilege Defined With Unsafe Actions.

What are the best practices for preventing Privilege Defined With Unsafe Actions?

The best practices for preventing Privilege Defined With Unsafe Actions include managing privileges carefully, explicitly managing trust zones in software, running code with lowest required privileges, and creating isolated accounts with limited privileges.

How do I fix Privilege Defined With Unsafe Actions in my code?

You can use the potential mitigations provided, such as environment hardening, to fix Privilege Defined With Unsafe Actions.

What are some related CWEs to Privilege Defined With Unsafe Actions?

Some related CWEs to Privilege Defined With Unsafe Actions include CWE-269 (Improper Privilege Management) and CAPEC-58, CAPEC-634, CAPEC-637, CAPEC-643, CAPEC-648.

How do I ask AI to check my code for Privilege Defined With Unsafe Actions?

You can use a copy-pasteable prompt with an AI coding assistant to review your code and rewrite it using primary fix techniques.

Vulnerabilities Related to Privilege Defined With Unsafe Actions

References

• MITRE CWE-267
• CAPEC-58, CAPEC-634, CAPEC-637, CAPEC-643, CAPEC-648
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Privilege Defined With Unsafe Actions and other risks before an attacker does.