CWE-268, Privilege Chaining, happens when two distinct privileges, roles, capabilities, or rights can be combined to let an entity do something it would not be allowed to do with either one alone.
Access reviews usually check rights one at a time. Chaining lives in the gaps between them.
How it happens
Each right is fine in isolation. Together they open a path. A common shape: one right lets you write to a place, another causes a privileged process to read from it.
MITRE's observed examples:
- CVE-2005-1736 (Gold): chaining of user rights.
- CVE-2002-1772 (Gold): gaining certain rights via privilege chaining in an alternate channel.
- CVE-2005-1973 (Gold): an application is allowed to assign extra permissions to itself.
- CVE-2003-0640 (Gold): an "operator" user can overwrite usernames and passwords to gain admin privileges.
The last one is easy to picture. The operator role is not admin. But it can edit credentials, and credentials are admin.
What an attacker gains
MITRE lists gaining privileges or assuming identity. A user can acquire the access rights of another user, including access information such as credentials.
How to find it
- Ask, for each role: can it modify anything that another, more powerful role relies on? Credentials, config, scripts, scheduled jobs, templates.
- Map "can write" against "gets executed or trusted by" across your system.
- Threat model with a question that crosses roles: starting as this user, how could I become that one?
- Treat any right that lets an actor grant rights as chain material.
How to fix it
- Remove the ability for lower roles to change data that higher roles trust.
- Separate duties so that no single role holds both ends of a chain.
- Do not let an application assign permissions to itself.
- Re-run the combination review whenever you add a role or a feature.
Role: operator
can: restart services, view logs
must not: edit user store, edit sudoers, edit job definitions
Quick check
Why do per role access reviews miss privilege chaining?
They check each right on its own. The risk comes from what two rights allow together, so the review has to consider combinations.
Sources
- MITRE CWE-268: https://cwe.mitre.org/data/definitions/268.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-268
