CWE-280, Improper Handling of Insufficient Permissions or Privileges, applies when a product does not handle correctly the case where it lacks permission to access a resource or function. It may follow an unexpected code path and leave itself in an invalid state.
It is the sibling of CWE-274, and the same developers hit both.
How it happens
A permission denied error arrives from an unusual place, and the fallback is wrong. MITRE's examples:
- CVE-2003-0501 (Gold): a special file system lets attackers prevent ownership or permission changes of certain entries by opening them before calling a setuid program.
- CVE-2004-0148 (Gold): an FTP server places a user in the root directory when the user's permissions prevent access to their own home directory.
The second one is the textbook case. The fallback turned a denial into more access.
What an attacker gains
MITRE records the impact as altered execution logic. The attacker engineers a denial and benefits from what the program does next.
How to find it
- Review each place where an access check can fail and read the else branch.
- Test with directories and files the process cannot read.
- Static analysis can find some instances.
How to fix it
Make the failure path as strict as the success path. If a home directory is not accessible, refuse the login or place the user in a safe empty location, never a broader one. Log the error and clean up partial state.
Quick check
What went wrong in the FTP server example?
When access to the user's home directory was denied, the server fell back to the root directory. The fallback granted more access than the original request.
Sources
- MITRE CWE-280: https://cwe.mitre.org/data/definitions/280.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-280
