CWE-1249 covers admin applications whose model of the underlying operating system does not match reality. Web based management consoles on cloud systems, network access devices and home networking gear are the typical cases. If you rely on such a console to see who has access, this is the weakness that makes it lie.
How it happens
Many products offer a web interface or other front end to manage the OS underneath. It may add, change and drop users with different privileges. A common design keeps its own list of accounts, or reads from a separate store, while the OS has its own list.
When the two diverge, the admin sees one set of entities and the system has another. MITRE's example is a Linux system where an attacker with root adds a new account directly to the OS password files. If the web interface does not refresh its data about available users, the new account never shows up in the console.
MITRE is candid about the limits: an attacker with root might well compromise the admin tool or feed it false data. The example still shows how a discrepancy in critical data helps attackers avoid detection.
What an attacker gains
The consequences in the record are access control, with effects that vary by context, and accountability: attackers can hide activities. There is also an unexpected state element, since the administrator is working from a false picture. Suspicious activity that would stand out in an accurate view goes unnoticed.
How to find it
The record lists no detection methods. A simple check is to compare views:
- List the accounts in the admin interface.
- List the accounts from the OS directly, for example from the system account files.
- Any difference needs an explanation.
Doing this on a schedule, rather than once, is the useful part.
How to fix it
MITRE's mitigation, at the design stage: make sure the admin tool refreshes its model of the underlying OS on a regular basis, and note any inconsistencies with configuration files or other data sources that are expected to hold the same data.
Two details matter. The refresh must be regular, not only at startup. And inconsistencies should be reported, not silently overwritten, because the mismatch itself is a signal worth an administrator's attention.
Quick check
Why would a console hide an account that exists on the OS?
Because it keeps its own model of the system and does not refresh it. An account added directly to the OS never reaches that model.
What should the tool do when it finds a mismatch?
Note the inconsistency, per MITRE, so an administrator can look into it. A mismatch can be the first sign of an intrusion.
