{"@ID": "1249", "@Name": "Application-Level Admin Tool with Inconsistent View of Underlying Operating System", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product provides an application for administrators to manage parts of the underlying operating system, but the application does not accurately identify all of the relevant entities or resources that exist in the OS; that is, the application's model of the OS's state is inconsistent with the OS's actual state.", "Extended_Description": {"xhtml:p": ["Many products provide web-based applications or other interfaces for managing the underlying operating system. This is common with cloud, network access devices, home networking, and other systems.  When the management tool does not accurately represent what is in the OS - such as user accounts - then the administrator might not see suspicious activities that would be noticed otherwise.", "For example, numerous systems utilize a web\n\t\t\t\tfront-end for administrative control. They also offer\n\t\t\t\tthe ability to add, alter, and drop users with various\n\t\t\t\tprivileges as it relates to the functionality of the\n\t\t\t\tsystem.  A potential architectural weakness may exist\n\t\t\t\twhere the user information reflected in the web\n\t\t\t\tinterface does not mirror the users in the underlying\n\t\t\t\toperating system.  Many web UI or REST APIs use the\n\t\t\t\tunderlying operating system for authentication; the\n\t\t\t\tsystem's logic may also track an additional set of\n\t\t\t\tuser capabilities within configuration files\n\t\t\t\tand datasets for authorization capabilities. When\n\t\t\t\tthere is a discrepancy between the user information in\n\t\t\t\tthe UI or REST API's interface system and the\n\t\t\t\tunderlying operating system's user listing, this may\n\t\t\t\tintroduce a weakness into the system.  For example, if an\n\t\t\t\tattacker compromises the OS and adds a new user\n\t\t\t\taccount - a \"ghost\" account - then the attacker could escape detection if\n\t\t\t\tthe management tool does not list the newly-added\n\t\t\t\taccount.", "This discrepancy could be exploited in several ways:", "Many of these attacker scenarios can be\n\t\t\t\trealized by leveraging separate vulnerabilities\n\t\t\t\trelated to XSS, command injection, authentication\n\t\t\t\tbypass, or logic flaws on the various systems."], "xhtml:ul": {"xhtml:li": ["A rogue admin could insert a new account into a system that will\npersist if they are terminated or wish to take action on a system that\ncannot be directly associated with them.", "An attacker can leverage a separate command injection attack available through the web interface to insert a ghost account with shell privileges such as ssh.", "An attacker can leverage existing web interface APIs, manipulated in such a way that a new user is inserted into the operating system, and the user web account is either partially created or not at all.", "An attacker could create an admin\n\t\t\t\t\t  account which is viewable by an administrator,\n\t\t\t\t\t  use this account to create the ghost account,\n\t\t\t\t\t  delete logs and delete the first created admin\n\t\t\t\t\t  account."]}}, "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "1250", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Operating_System": {"@Class": "Not OS-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Web Based", "@Prevalence": "Undetermined"}}, "Alternate_Terms": {"Alternate_Term": {"Term": "Ghost in the Shell"}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design", "Note": "The design might assume that the underlying OS does not change."}, {"Phase": "Implementation", "Note": "Assumptions about the underlying OS might be hard-coded into the application or otherwise in external data stores in a way that is not updated when the OS's state changes."}]}, "Common_Consequences": {"Consequence": [{"Scope": "Access Control", "Impact": "Varies by Context"}, {"Scope": "Accountability", "Impact": "Hide Activities"}, {"Scope": "Other", "Impact": "Unexpected State"}]}, "Potential_Mitigations": {"Mitigation": {"Phase": "Architecture and Design", "Description": {"xhtml:p": "Ensure that the admin tool refreshes its model of the underlying OS on a regular basis, and note any inconsistencies with configuration files or other data sources that are expected to have the same data."}}}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": "Suppose that an attacker successfully gains root privileges on a Linux system and adds a new 'user2' account:", "Example_Code": {"@Nature": "Attack", "@Language": "Other", "xhtml:div": ["echo \"user2:x:0:0::/root:/\" >> /etc/passwd;", "echo\n\t\t\t\t\t  \"user2:\\$6\\$IdvyrM6VJnG8Su5U\\$1gmW3Nm.IO4vxTQDQ1C8urm72JCadOHZQwqiH/nRtL8dPY80xS4Ovsv5bPCMWnXKKWwmsocSWXupUf17LB3oS.:17256:0:99999:7:::\" >> /etc/shadow;"]}, "Body_Text": ["This new user2 account would not be noticed on the web interface, if the interface does not refresh its data of available users.", "It could be argued that for this specific example, an attacker with root privileges would be likely to compromise the admin tool or otherwise feed it with false data.  However, this example shows how the discrepancy in critical data can help attackers to escape detection."]}}, "References": {"Reference": {"@External_Reference_ID": "REF-1070"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "Tony Martin", "Submission_Date": "2019-06-06", "Submission_Version": "4.0", "Submission_ReleaseDate": "2020-02-24"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}]}}