CWE-250: Execution with Unnecessary Privileges

Description:
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Affected languages: Not Language-Specific
Affected technologies: AI/ML, Mobile
Parent weaknesses: CWE-269, CWE-657

Consequences:
  - Confidentiality: Gain Privileges or Assume Identity

Detection methods:
  - Manual Analysis: This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and m
  - Black Box: Use monitoring tools that examine the software's process as it interacts with the operating system and the network. This technique is useful in cases when source code is unavailable, if the software w
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Mitigations:
  - [Architecture and Design] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the s
  - [Architecture and Design] Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop th
  - [Architecture and Design] Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop th
  - [Implementation] Perform extensive input validation for any privileged code that must be exposed to the user and reject anything that does not fit your strict requirements.

Demonstrative examples:
This code temporarily raises the program's privileges to allow creation of a new user folder.
While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.
def makeNewUserDir(username): 
                         if invalidUsername(username): 
                               
                                  
                                  #avoid CWE-22 and CWE-78 
                                  print('Usernames cannot contain invalid characters') return False 
                            
                            try: rai

The following code calls chroot() to restrict the application to a subset of the filesystem below APP_HOME in order to prevent an attacker from using the program to gain unauthorized access to files located elsewhere. The code then opens a file specified by the user and processes the contents of the file.
Constraining the process inside the application's home directory before opening any files is a valuable security measure. However, the absence of a call to setuid() with some non-zero value means the application is continuing to operate with unnecessary root privileges. Any successful exploit carried out by an attacker against the application can now result in a privilege escalation attack because any malicious operations will be performed with the privileges of the superuser. If the appl

Real-world examples:
  - CVE-2007-4217: FTP client program on a certain OS runs with setuid privileges and has a buffer overflow. Most clients do not need extra privileges, so an overflow is not a vulnerability for those clients.
  - CVE-2008-1877: Program runs with privileges and calls another program with the same privileges, which allows read of arbitrary files.
  - CVE-2007-5159: OS incorrectly installs a program with setuid privileges, allowing users to gain privileges.
  - CVE-2008-4638: Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).
  - CVE-2008-0162: Program does not drop privileges before calling another program, allowing code execution.