CWE-279, Incorrect Execution-Assigned Permissions, is a program that, while running, sets the permissions of an object in a way that violates the permissions the user specified.
Think of any service that creates files, sockets, or shared objects at runtime.
How it happens
A developer hardcodes a permissive mode when creating a file, ignoring configuration or a restrictive umask. The user asked for private; the program decided otherwise.
All three of MITRE's observed examples are the same shape: log files opened read and write. See CVE-2002-0265 (Gold), CVE-2003-0876 (Gold), and CVE-2002-1694 (Gold).
# Vulnerable: forces a permissive mode regardless of configuration
import os
fd = os.open("app.log", os.O_CREAT | os.O_WRONLY, 0o666)
What an attacker gains
MITRE lists reading and modifying application data. A writable log lets a local attacker tamper with evidence or inject content. A readable one may leak whatever the program logs.
How to find it
- Grep for file creation calls with broad modes such as 0666 or 0777.
- Run the program and inspect the modes of what it creates.
- Static analysis can flag some instances.
How to fix it
fd = os.open("app.log", os.O_CREAT | os.O_WRONLY, 0o640)
Use the narrowest mode that works, honor the configured umask where appropriate, and make the mode a documented setting rather than a literal buried in code.
Quick check
Why is a world-writable log file a security problem and not just sloppy?
Any local user can alter it, which can hide an attacker's activity or feed false data to whoever reads the log later.
Sources
- MITRE CWE-279: https://cwe.mitre.org/data/definitions/279.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-279
