The software does not drop privileges before passing control of a resource to an actor that does not have those privileges.
Extended Description
In some contexts, a system executing with elevated permissions will hand off a process/file/etc. to another process or user. If the privileges of an entity are not reduced, then elevated privileges are spread throughout a system and possibly to an attacker.
Time of Introduction
Architecture and Design
Implementation
Operation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Gain privileges / assume
identity
Windows program running as SYSTEM does not drop
privileges before executing other programs (many others like this,
especially involving the Help facility).
Service on Windows does not drop privileges before
using "view file" option, allowing code
execution.
Potential Mitigations
Phase: Architecture and Design
Ensure that appropriate compartmentalization is built into the system
design and that the compartmentalization serves to allow for and further
reinforce privilege separation functionality. Architects and designers
should rely on the principle of least privilege to decide when it is
appropriate to use and to drop system privileges.
Phases: Architecture and Design; Operation
Very carefully manage the setting, management, and handling of
privileges. Explicitly manage trust zones in the software.
Consider following the principle of separation of privilege. Require
multiple conditions to be met before permitting access to a system
resource.
Weakness Ordinalities
Ordinality
Description
Primary
(where
the weakness exists independent of other weaknesses)
Description
