CWE-281, Improper Preservation of Permissions, is a product that does not preserve permissions, or preserves them incorrectly, when copying, restoring, or sharing objects. The copy ends up with less restrictive permissions than the original.
Backup tools, file synchronizers, cloning features, and migration scripts are the usual places.
How it happens
Permissions are metadata, and metadata is easy to lose. A copy command that creates a new file uses default modes. A restore routine applies the wrong access list. A filesystem mount remaps permissions automatically.
MITRE's examples:
- CVE-2002-2323 (Gold): incorrect ACLs used when restoring backups from directories that use symbolic links.
- CVE-2001-1515 (Gold): automatic modification of permissions inherited from another file system.
- CVE-2005-1920 (Gold): permissions on a backup file are created with defaults, possibly less secure than the original.
- CVE-2001-0195 (Gold): a file is made world-readable when being cloned.
# Vulnerable: copy creates a new file with default permissions
shutil.copyfile("secrets.conf", "backup/secrets.conf")
What an attacker gains
MITRE lists confidentiality and integrity impact: reading and modifying application data. A private file that becomes readable in a backup directory is as exposed as if the original were public.
How to find it
- After any backup, restore, or clone, compare modes and ACLs of source and destination.
- Test with files that have restrictive modes and with symbolic links.
- Check whether your tooling treats permissions as data worth copying.
stat -c '%a %U %n' secrets.conf backup/secrets.conf
How to fix it
Use copy functions that preserve metadata, then verify the result, and create backup locations with restrictive permissions of their own.
shutil.copy2("secrets.conf", "backup/secrets.conf")
os.chmod("backup/secrets.conf", 0o600)
Treat the permission comparison as a test case for your backup and restore process.
Quick check
Why check a backup's permissions separately from the original's?
The backup is a new object. If the copy process does not preserve permissions, the backup can be more exposed than the file it protects.
Sources
- MITRE CWE-281: https://cwe.mitre.org/data/definitions/281.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-281
