CWE

CWE-273 – Improper Check for Dropped Privileges

Read Time:1 Minute, 39 Second

Description

The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

If the drop fails, the software will continue to run with the raised privileges, which might provide additional access to unprivileged users.

In Windows based environments that have access control, impersonation is used so that access checks can be performed on a client identity by a server with higher privileges. By impersonating the client, the server is restricted to client-level security — although in different threads it may have much higher privileges.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: Medium

 

Related Weaknesses

CWE-754
CWE-754
CWE-271
CWE-252

 

Consequences

Access Control: Gain Privileges or Assume Identity

If privileges are not dropped, neither are access rights of the user. Often these rights can be prevented from being dropped.

Access Control, Non-Repudiation: Gain Privileges or Assume Identity, Hide Activities

If privileges are not dropped, in some cases the system may record actions as the user which is being impersonated rather than the impersonator.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Phase: Implementation

Effectiveness: High

Description: 

Check the results of all functions that return a value and verify that the value is expected.

Checking the return value of the function will typically be sufficient, however beware of race conditions (CWE-362) in a concurrent environment.

Phase: Implementation

Description: 

In Windows, make sure that the process token has the SeImpersonatePrivilege(Microsoft Server 2003). Code that relies on impersonation for security must ensure that the impersonation succeeded, i.e., that a proper privilege demotion happened.

CVE References

  • CVE-2006-4447
    • Program does not check return value when invoking functions to drop privileges, which could leave users with higher privileges than expected by forcing those functions to fail.
  • CVE-2006-2916
    • Program does not check return value when invoking functions to drop privileges, which could leave users with higher privileges than expected by forcing those functions to fail.