CWE-268: Privilege Chaining Weakness ID: 268 (Weakness Base) Status: Draft
Description
Description Summary
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
Time of Introduction
Architecture and Design
Implementation
Operation
Common Consequences
Scope Effect Access Control
Technical Impact: Gain privileges / assume
identity
Likelihood of Exploit
Observed Examples
Reference Description CVE-2005-1736 Chaining of user
rights. CVE-2002-1772 Gain certain rights via privilege chaining in
alternate channel. CVE-2005-1973 Application is allowed to assign extra permissions
to itself. CVE-2003-0640 "operator" user can overwrite usernames and
passwords to gain admin privileges.
Potential Mitigations
Consider following the principle of separation of privilege. Require
multiple conditions to be met before permitting access to a system
resource.
Phases: Architecture and Design; Operation
Very carefully manage the setting, management, and handling of
privileges. Explicitly manage trust zones in the software.
Follow the principle of least privilege when assigning access rights
to entities in a software system.
Weakness Ordinalities
Ordinality Description Primary
(where
the weakness exists independent of other weaknesses)
Relationships
Relationship Notes
There is some conceptual overlap with Unsafe Privilege.
Research Gaps
It is difficult to find good examples for this weakness.
Causal Nature
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Privilege Chaining
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships, Other_Notes, Relationship_Notes,
Taxonomy_Mappings, Weakness_Ordinalities 2009-03-10 CWE Content Team MITRE Internal updated Relationships 2009-12-28 CWE Content Team MITRE Internal updated Other_Notes, Potential_Mitigations,
Research_Gaps 2010-06-21 CWE Content Team MITRE Internal updated Potential_Mitigations 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences
Description
