Privilege Chaining
Weakness ID: 268 (Weakness Base)Status: Draft
+ Description

Description Summary

Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
+ Time of Introduction
  • Architecture and Design
  • Implementation
  • Operation
+ Applicable Platforms

Languages

All

+ Likelihood of Exploit

High

+ Observed Examples
ReferenceDescription
CVE-2005-1736Chaining of user rights.
CVE-2002-1772Gain certain rights via privilege chaining in alternate channel.
CVE-2005-1973Application is allowed to assign extra permissions to itself.
CVE-2003-0640"operator" user can overwrite usernames and passwords to gain admin privileges.
+ Potential Mitigations

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Very carefully manage the setting, management and handling of privileges. Explicitly manage trust zones in the software.

Follow the principle of least privilege when assigning access rights to entities in a software system.

+ Weakness Ordinalities
OrdinalityDescription
Primary
(where the weakness exists independent of other weaknesses)
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory265Privilege / Sandbox Issues
Development Concepts (primary)699
ChildOfWeakness BaseWeakness Base269Improper Privilege Management
Research Concepts (primary)1000
ChildOfCategoryCategory723OWASP Top Ten 2004 Category A2 - Broken Access Control
Weaknesses in OWASP Top Ten (2004) (primary)711
+ Relationship Notes

There is some conceptual overlap with Unsafe Privilege.

+ Research Gaps

It is difficult to find good examples for this weakness.

+ Causal Nature

Explicit

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERPrivilege Chaining
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Other Notes, Relationship Notes, Taxonomy Mappings, Weakness Ordinalities
2009-03-10CWE Content TeamMITREInternal
updated Relationships
2009-12-28CWE Content TeamMITREInternal
updated Other Notes, Potential Mitigations, Research Gaps
Back to top