CWE-250
AllowedExecution with Unnecessary Privileges
Abstraction: Base · Status: Draft
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
604 vulnerabilities reference this CWE, most recent first.
GHSA-2429-6423-P4JM
Vulnerability from github – Published: 2026-03-10 18:31 – Updated: 2026-05-07 21:30Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionline: from 1.0 before 1.33.
{
"affected": [],
"aliases": [
"CVE-2026-3315"
],
"database_specific": {
"cwe_ids": [
"CWE-250",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-10T18:19:01Z",
"severity": "MODERATE"
},
"details": "Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionline: from 1.0 before 1.33.",
"id": "GHSA-2429-6423-p4jm",
"modified": "2026-05-07T21:30:22Z",
"published": "2026-03-10T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3315"
},
{
"type": "WEB",
"url": "https://https://www.vingcard.com/en/service-and-support/product-security-center"
},
{
"type": "WEB",
"url": "https://www.vingcard.com/en/service-and-support/product-security-center/hospitality-product-security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Clear",
"type": "CVSS_V4"
}
]
}
GHSA-25P8-9WV3-J93J
Vulnerability from github – Published: 2024-07-22 21:30 – Updated: 2024-09-11 18:31Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0.
{
"affected": [],
"aliases": [
"CVE-2024-6913"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T21:15:05Z",
"severity": "CRITICAL"
},
"details": "Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0.",
"id": "GHSA-25p8-9wv3-j93j",
"modified": "2024-09-11T18:31:01Z",
"published": "2024-07-22T21:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6913"
},
{
"type": "WEB",
"url": "https://cyberdanube.com/en/en-multiple-vulnerabilities-in-perten-processplus"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-273C-4G26-4JPM
Vulnerability from github – Published: 2025-10-30 12:31 – Updated: 2025-10-30 17:08API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-62402"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-30T17:08:56Z",
"nvd_published_at": "2025-10-30T10:15:35Z",
"severity": "MODERATE"
},
"details": "API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.",
"id": "GHSA-273c-4g26-4jpm",
"modified": "2025-10-30T17:08:56Z",
"published": "2025-10-30T12:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62402"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/56609"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/828aaa0b1d95caf90612a648867c17aec7e87874"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/10/29/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow `/api/v2/dagReports` executes DAG Python in API"
}
GHSA-27J2-98FJ-7R5W
Vulnerability from github – Published: 2022-04-28 00:00 – Updated: 2022-05-12 00:01In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.
{
"affected": [],
"aliases": [
"CVE-2021-34591"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-27T16:15:00Z",
"severity": "HIGH"
},
"details": "In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.",
"id": "GHSA-27j2-98fj-7r5w",
"modified": "2022-05-12T00:01:21Z",
"published": "2022-04-28T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34591"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2021-047"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-27P7-X38V-2JC5
Vulnerability from github – Published: 2025-08-12 12:30 – Updated: 2025-08-12 12:30A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate security controls to enforce isolation. This could allow an attacker to gain elevated access, potentially accessing sensitive host system resources.
{
"affected": [],
"aliases": [
"CVE-2025-40767"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-12T12:15:37Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \u003c V3.0). The affected application runs docker containers without adequate security controls to enforce isolation. This could allow an attacker to gain elevated access, potentially accessing sensitive host system resources.",
"id": "GHSA-27p7-x38v-2jc5",
"modified": "2025-08-12T12:30:33Z",
"published": "2025-08-12T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40767"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-517338.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2CF4-4HV6-CCXC
Vulnerability from github – Published: 2025-05-10 03:30 – Updated: 2025-05-10 03:30IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization.
{
"affected": [],
"aliases": [
"CVE-2025-1137"
],
"database_specific": {
"cwe_ids": [
"CWE-250",
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-10T03:15:22Z",
"severity": "HIGH"
},
"details": "IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization.",
"id": "GHSA-2cf4-4hv6-ccxc",
"modified": "2025-05-10T03:30:23Z",
"published": "2025-05-10T03:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1137"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7233085"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2GHC-9393-F9WV
Vulnerability from github – Published: 2025-12-23 18:30 – Updated: 2025-12-23 18:30NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.
{
"affected": [],
"aliases": [
"CVE-2025-33223"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-23T17:15:47Z",
"severity": "CRITICAL"
},
"details": "NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.",
"id": "GHSA-2ghc-9393-f9wv",
"modified": "2025-12-23T18:30:27Z",
"published": "2025-12-23T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33223"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5749"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-33223"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2J3P-GQW5-G59J
Vulnerability from github – Published: 2026-03-02 17:44 – Updated: 2026-03-02 21:59Impact
Vulnerability Type: Local Privilege Escalation (LPE) / Improper Privilege Management / Arbitrary Command Execution.
The application automatically re-executes the previously failed command but does not properly drop elevated privileges during this process.
When the tool is executed with sudo or otherwise runs with an effective UID of root, it records the last executed command and attempts to rerun it. However, the application fails to restore the original unprivileged user context before re-executing the command. As a result, the retried command is executed with root privileges, even if the original command was issued by an unprivileged user.
This allows a local attacker to intentionally trigger a failed command under elevated execution and gain arbitrary command execution as root via the retry mechanism.
Who is impacted:
Any system where this tool is executed with elevated privileges is affected. The risk is especially high in environments where the tool is permitted to run via sudo, including configurations with NOPASSWD, as an unprivileged user can escalate privileges to root without additional interaction.
Proof of Concept
To verify the vulnerability without a shell, attempt to create a file in a root-protected directory.
1. Verify the file does not exist
sudo ls /root/proof_of_lpe
# Output: No such file or directory
2. Run the vulnerable command
sudo bash -c "SH_PREV_CMD='touch /root/proof_of_lpe' target/release/theshit fix"
3. Check if the file was created by root
sudo ls -l /root/proof_of_lpe
Expected Result:
The command succeeds silently, and the file /root/proof_of_lpe is created, confirming arbitrary command execution with root privileges.
Patches
The issue has been fixed in version 0.1.2.
The patch ensures that privilege levels are correctly handled during command re-execution. Before retrying any previously executed command, the application now explicitly resets the effective UID and GID to the original invoking user.
Workarounds
If upgrading is not possible, users should avoid executing the application with sudo or as the root user.
As a temporary mitigation, administrators should restrict the use of the tool in privileged contexts and ensure it is not included in sudoers configurations, particularly with NOPASSWD. Running the tool strictly as an unprivileged user prevents exploitation of the retry mechanism.
References
- Commit fixing the issue
- CWE-269: Improper Privilege Management
- CWE-273: Improper Check for Dropped Privileges
- CWE-250: Execution with Unnecessary Privileges
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "theshit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-21882"
],
"database_specific": {
"cwe_ids": [
"CWE-250",
"CWE-269",
"CWE-273"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-02T17:44:53Z",
"nvd_published_at": "2026-03-02T20:16:26Z",
"severity": "HIGH"
},
"details": "### Impact\n\n**Vulnerability Type:** Local Privilege Escalation (LPE) / Improper Privilege Management / Arbitrary Command Execution.\n\nThe application automatically re-executes the previously failed command but does not properly drop elevated privileges during this process.\n\nWhen the tool is executed with `sudo` or otherwise runs with an effective UID of root, it records the last executed command and attempts to rerun it. However, the application fails to restore the original unprivileged user context before re-executing the command. As a result, the retried command is executed with root privileges, even if the original command was issued by an unprivileged user.\n\nThis allows a local attacker to intentionally trigger a failed command under elevated execution and gain arbitrary command execution as root via the retry mechanism.\n\n**Who is impacted:**\nAny system where this tool is executed with elevated privileges is affected. The risk is especially high in environments where the tool is permitted to run via `sudo`, including configurations with `NOPASSWD`, as an unprivileged user can escalate privileges to root without additional interaction.\n\n### Proof of Concept\n\nTo verify the vulnerability without a shell, attempt to create a file in a root-protected directory.\n\n**1. Verify the file does not exist**\n```bash\nsudo ls /root/proof_of_lpe\n# Output: No such file or directory\n```\n\n**2. Run the vulnerable command**\n```bash\nsudo bash -c \"SH_PREV_CMD=\u0027touch /root/proof_of_lpe\u0027 target/release/theshit fix\"\n```\n\n**3. Check if the file was created by root**\n```bash\nsudo ls -l /root/proof_of_lpe\n```\n\n**Expected Result:**\nThe command succeeds silently, and the file `/root/proof_of_lpe` is created, confirming arbitrary command execution with root privileges.\n\n### Patches\n\nThe issue has been fixed in version **0.1.2**.\n\nThe patch ensures that privilege levels are correctly handled during command re-execution. Before retrying any previously executed command, the application now explicitly resets the effective UID and GID to the original invoking user.\n\n### Workarounds\n\nIf upgrading is not possible, users should avoid executing the application with `sudo` or as the root user.\n\nAs a temporary mitigation, administrators should restrict the use of the tool in privileged contexts and ensure it is not included in `sudoers` configurations, particularly with `NOPASSWD`. Running the tool strictly as an unprivileged user prevents exploitation of the retry mechanism.\n\n### References\n\n* [Commit fixing the issue](https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a)\n* CWE-269: Improper Privilege Management\n* CWE-273: Improper Check for Dropped Privileges\n* CWE-250: Execution with Unnecessary Privileges",
"id": "GHSA-2j3p-gqw5-g59j",
"modified": "2026-03-02T21:59:23Z",
"published": "2026-03-02T17:44:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-2j3p-gqw5-g59j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21882"
},
{
"type": "WEB",
"url": "https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a"
},
{
"type": "PACKAGE",
"url": "https://github.com/AsfhtgkDavid/theshit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "theshit\u0027s Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution"
}
GHSA-2MMX-JX99-8CMF
Vulnerability from github – Published: 2025-10-28 21:30 – Updated: 2026-01-21 21:30HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.
{
"affected": [],
"aliases": [
"CVE-2025-43017"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-28T21:15:37Z",
"severity": "HIGH"
},
"details": "HP ThinPro 8.1 System management application failed to verify user\u0027s true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.",
"id": "GHSA-2mmx-jx99-8cmf",
"modified": "2026-01-21T21:30:28Z",
"published": "2025-10-28T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43017"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_13164593-13164617-16/hpsbhf04066"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2RHX-QHXP-5JPW
Vulnerability from github – Published: 2024-05-17 15:31 – Updated: 2026-04-06 17:19A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/submariner-io/submariner-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0.16.0-m0"
},
{
"fixed": "0.16.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/submariner-io/submariner-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0.17.0-m0"
},
{
"fixed": "0.17.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/submariner-io/submariner-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.15.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/submariner-io/submariner-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0.18.0-m0"
},
{
"fixed": "0.18.0-rc0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-5042"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-17T20:03:57Z",
"nvd_published_at": "2024-05-17T14:15:21Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.",
"id": "GHSA-2rhx-qhxp-5jpw",
"modified": "2026-04-06T17:19:54Z",
"published": "2024-05-17T15:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5042"
},
{
"type": "WEB",
"url": "https://github.com/submariner-io/submariner-operator/issues/3041"
},
{
"type": "WEB",
"url": "https://github.com/submariner-io/submariner-operator/pull/3040"
},
{
"type": "WEB",
"url": "https://github.com/submariner-io/submariner-operator/pull/3045"
},
{
"type": "WEB",
"url": "https://github.com/submariner-io/submariner-operator/pull/3046"
},
{
"type": "WEB",
"url": "https://github.com/submariner-io/submariner-operator/pull/3049"
},
{
"type": "WEB",
"url": "https://github.com/submariner-io/submariner-operator/commit/b27a04c4270e53cbff6ff8ac6245db10c204bcab"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4591"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6503"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-5042"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280921"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-2rhx-qhxp-5jpw"
},
{
"type": "PACKAGE",
"url": "https://github.com/submariner-io/submariner-operator"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Submariner Operator sets unnecessary RBAC permissions"
}
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-18
Strategy: Separation of Privilege
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
Mitigation MIT-18
Strategy: Attack Surface Reduction
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
Mitigation
Perform extensive input validation for any privileged code that must be exposed to the user and reject anything that does not fit your strict requirements.
Mitigation MIT-19
When dropping privileges, ensure that they have been dropped successfully to avoid CWE-273. As protection mechanisms in the environment get stronger, privilege-dropping calls may fail even if it seems like they would always succeed.
Mitigation
If circumstances force you to run with extra privileges, then determine the minimum access level necessary. First identify the different permissions that the software and its users will need to perform their actions, such as file read and write permissions, network socket permissions, and so forth. Then explicitly allow those actions while denying all else [REF-76]. Perform extensive input validation and canonicalization to minimize the chances of introducing a separate vulnerability. This mitigation is much more prone to error than dropping the privileges in the first place.
Mitigation MIT-37
Strategy: Environment Hardening
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
CAPEC-104: Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security.
CAPEC-470: Expanding Control over the Operating System from the Database
An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
CAPEC-69: Target Programs with Elevated Privileges
This attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.