Least Privilege Violation

C/C++

Abstract

chroot()와 같은 작업을 수행하는 데 필요한 높은 수준의 권한은 작업을 수행한 직후 삭제해야 합니다.

Explanation

프로그램이 chroot() 등의 권한 있는 함수를 호출하려면 먼저 root 권한을 획득해야 합니다. 권한 있는 작업이 완료되자 마자 프로그램은 root 권한을 삭제하고 호출한 사용자의 권한 수준으로 돌아가야 합니다.
예제: 다음 코드는 공격자가 프로그램을 사용하여 다른 곳에 있는 파일에 무단으로 접근하는 것을 방지하기 위해 chroot()를 호출하여 응용 프로그램을 APP_HOME 밑의 파일 시스템의 부분 집합으로 제한합니다. 그런 다음 코드는 사용자가 지정한 파일을 열고 파일의 내용을 처리합니다.


...
chroot(APP_HOME);
chdir("/");

FILE* data = fopen(argv[1], "r+");
...

파일을 열기 전에 프로세스를 응용 프로그램의 홈 디렉터리 내부로 제한하는 것은 훌륭한 보안 대책입니다. 하지만 0이 아닌 값으로 setuid()를 호출하지 않으면 응용 프로그램이 계속 불필요한 root 권한으로 동작하게 됩니다. 악의적인 연산이 수퍼유저 권한으로 수행되기 때문에 공격자가 응용 프로그램에 대한 익스플로이트에 성공하면 권한 상승 공격이 일어날 수 있습니다. 응용 프로그램이 root 사용자가 아닌 권한 수준으로 떨어지면 피해 가능성이 대폭 줄어듭니다.

References

[1] A. Chuvakin Using Chroot Securely

[2] Standards Mapping - Common Weakness Enumeration CWE ID 272

[3] Standards Mapping - Common Weakness Enumeration Top 25 2023 [22] CWE ID 269

[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000381, CCI-002233, CCI-002235

[5] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-6 Least Privilege (P1), CM-7 Least Functionality (P1)

[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-6 Least Privilege, CM-7 Least Functionality

[8] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.4.3 Access Control Architectural Requirements (L2 L3), 1.4.3 Access Control Architectural Requirements (L2 L3), 10.2.2 Malicious Code Search (L2 L3)

[9] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[10] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[11] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 7.1.1

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 7.1.1

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[22] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[43] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[44] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.controlflow.cpp.least_privilege_violation