Incorrect Privilege Assignment
Description
Incorrect Privilege Assignment is a vulnerability that occurs when a product incorrectly assigns a privilege, role, capability, or permission to a particular actor, creating an unintended sphere of control for that entity. This weakness can manifest in multiple ways: granting elevated privileges during user creation, assigning users to incorrect groups, applying wrong permission sets to resources, or failing to properly restrict privilege inheritance. The result is that actors gain access to functionality or data they should not be able to access, potentially including administrative capabilities, sensitive information, or control over other users' resources.
Risk
Incorrect privilege assignment creates significant security risks by providing unauthorized access to protected resources and functionality. Users with incorrectly elevated privileges can access sensitive data, modify system configurations, create or delete accounts, and perform actions reserved for administrators. In multi-tenant environments, privilege assignment errors may allow cross-tenant access. The risk is amplified when privilege assignment occurs during automated processes like user provisioning, role-based access control implementation, or permission synchronization, where errors can affect many users simultaneously. Attackers who identify privilege assignment flaws can exploit them for privilege escalation, lateral movement, and persistent access.
Solution
Implement the principle of least privilege, ensuring users receive only the minimum permissions necessary for their tasks. Use role-based access control (RBAC) with carefully defined roles that map to specific job functions. Implement automated privilege auditing to detect assignment errors. Create separation between user provisioning and privilege assignment processes with appropriate approval workflows. Test privilege assignment logic thoroughly, including edge cases and boundary conditions. Implement logging and alerting for privilege changes. Use group membership and role assignment reviews to periodically validate that privileges remain appropriate. Avoid direct privilege assignment where possible, preferring role-based mechanisms that are easier to audit.
Common Consequences
| Impact | Details |
|---|---|
| Access Control | Scope: Access Control Users can access restricted functionality and sensitive information through incorrectly assigned privileges. This may include administrative capabilities, other users' accounts, and protected resources beyond the intended access scope. |
Example Code
Vulnerable Code (Python/Django)
The following code demonstrates incorrect privilege assignment patterns:
from django.contrib.auth.models import User, Group
from django.db import models
class VulnerableUserService:
def create_user(self, username, email, role_name):
user = User.objects.create_user(username=username, email=email)
# Vulnerable: Incorrect group assignment logic
if role_name == "admin":
# Correct: Admin group
admin_group = Group.objects.get(name="Administrators")
user.groups.add(admin_group)
elif role_name == "manager":
# BUG: Accidentally assigns admin privileges to managers!
admin_group = Group.objects.get(name="Administrators")
user.groups.add(admin_group) # Should be "Managers" group
else:
# Default user
user_group = Group.objects.get(name="Users")
user.groups.add(user_group)
return user
def copy_user_permissions(self, source_user, target_user):
# Vulnerable: Blindly copies all permissions including sensitive ones
target_user.groups.set(source_user.groups.all())
target_user.user_permissions.set(source_user.user_permissions.all())
target_user.save()
def promote_user(self, user, new_role):
# Vulnerable: No validation that promotion is authorized
# Any user can call this and promote themselves
if new_role == "admin":
admin_group = Group.objects.get(name="Administrators")
user.groups.add(admin_group)
user.is_staff = True
user.is_superuser = True # Grants all permissions!
user.save()
// Vulnerable Java example
public class VulnerableRoleService {
public void assignRole(User user, String roleName) {
// Vulnerable: Uses user-supplied role without validation
Role role = roleRepository.findByName(roleName);
if (role != null) {
// No check if current user is authorized to assign this role
// No check if target user should receive this role
user.getRoles().add(role);
userRepository.save(user);
}
}
public void createServiceAccount(String name, String purpose) {
User serviceAccount = new User();
serviceAccount.setUsername(name);
serviceAccount.setServiceAccount(true);
// Vulnerable: Service accounts get excessive default privileges
Role serviceRole = roleRepository.findByName("SERVICE_ADMIN");
serviceAccount.getRoles().add(serviceRole); // Too much access!
userRepository.save(serviceAccount);
}
}
Fixed Code (Python/Django)
from django.contrib.auth.models import User, Group, Permission
from django.core.exceptions import PermissionDenied
import logging
logger = logging.getLogger(__name__)
class SecureUserService:
# Define valid role mappings
ROLE_MAPPINGS = {
"admin": "Administrators",
"manager": "Managers",
"analyst": "Analysts",
"user": "Users"
}
# Roles that require elevated authorization to assign
PRIVILEGED_ROLES = {"admin", "manager"}
def create_user(self, username, email, role_name, created_by):
# Validate role name
if role_name not in self.ROLE_MAPPINGS:
raise ValueError(f"Invalid role: {role_name}")
# Check if creator is authorized to assign this role
if role_name in self.PRIVILEGED_ROLES:
if not created_by.has_perm('auth.assign_privileged_roles'):
logger.warning(
f"Unauthorized privilege assignment attempt: "
f"{created_by.username} tried to assign {role_name}"
)
raise PermissionDenied("Not authorized to assign this role")
user = User.objects.create_user(username=username, email=email)
# Use validated role mapping
group_name = self.ROLE_MAPPINGS[role_name]
group = Group.objects.get(name=group_name)
user.groups.add(group)
# Audit log
logger.info(
f"User {username} created with role {role_name} by {created_by.username}"
)
return user
def assign_role(self, user, role_name, assigned_by):
"""Secure role assignment with authorization checks"""
# Validate role
if role_name not in self.ROLE_MAPPINGS:
raise ValueError(f"Invalid role: {role_name}")
# Check authorization for privileged role assignment
if role_name in self.PRIVILEGED_ROLES:
if not self._can_assign_privileged_role(assigned_by, user, role_name):
raise PermissionDenied("Not authorized for this role assignment")
group_name = self.ROLE_MAPPINGS[role_name]
group = Group.objects.get(name=group_name)
# Clear existing roles and assign new one
user.groups.clear()
user.groups.add(group)
# Update staff/superuser flags appropriately
user.is_staff = role_name in self.PRIVILEGED_ROLES
user.is_superuser = (role_name == "admin")
user.save()
logger.info(
f"Role {role_name} assigned to {user.username} by {assigned_by.username}"
)
def _can_assign_privileged_role(self, assigner, target, role):
"""Check if assigner can assign role to target"""
# Cannot assign to self
if assigner.id == target.id:
return False
# Must have role assignment permission
if not assigner.has_perm('auth.assign_privileged_roles'):
return False
# Admin role requires superuser
if role == "admin" and not assigner.is_superuser:
return False
return True
def copy_permissions_safely(self, source_user, target_user, copied_by):
"""Copy permissions with filtering"""
# Don't copy privileged permissions
EXCLUDED_PERMISSIONS = [
'auth.assign_privileged_roles',
'auth.delete_user',
'admin.full_access'
]
# Copy groups (excluding admin groups)
safe_groups = source_user.groups.exclude(name="Administrators")
target_user.groups.set(safe_groups)
# Copy individual permissions (excluding dangerous ones)
safe_permissions = source_user.user_permissions.exclude(
codename__in=[p.split('.')[1] for p in EXCLUDED_PERMISSIONS]
)
target_user.user_permissions.set(safe_permissions)
target_user.save()
logger.info(
f"Permissions copied from {source_user.username} to "
f"{target_user.username} by {copied_by.username}"
)
The fix implements proper role validation, authorization checks for privileged role assignment, prevents self-promotion, excludes dangerous permissions from copy operations, and logs all privilege changes.
Exploited in the Wild
Unix Wheel Group Vulnerability (Unix Systems, 1999)
CVE-1999-1193 documented a classic privilege assignment error where an untrusted user was incorrectly placed in the Unix "wheel" group, which traditionally grants sudo/su access. This allowed the user to escalate to root privileges, demonstrating how incorrect group membership can lead to complete system compromise.
AWS IAM Privilege Escalation (Multiple Organizations, Ongoing)
Misconfigured AWS IAM policies have led to numerous privilege escalation incidents where users were inadvertently granted permissions to modify their own IAM policies or assume roles with elevated access. Attackers exploit these assignment errors to escalate from limited access to administrative control over AWS accounts.
Active Directory Group Nesting Issues (Enterprise Environments, Ongoing)
Complex Active Directory group nesting has led to users inheriting administrative privileges through transitive group membership. Users added to seemingly innocuous groups inadvertently gained domain admin access through nested group relationships, enabling unauthorized access to sensitive systems.
Tools to Test/Exploit
-
BloodHound — Active Directory privilege path analysis tool that identifies privilege assignment issues and escalation paths.
-
Prowler — AWS security assessment tool that identifies IAM privilege assignment misconfigurations.
-
PrincipalMapper — AWS IAM analysis tool for identifying incorrect privilege assignments and escalation paths.
CVE Examples
-
CVE-1999-1193 — Untrusted user incorrectly placed in Unix wheel group enabling privilege escalation.
-
CVE-2005-2741 — Product allowed users to grant themselves certain rights for privilege escalation.
-
CVE-2005-2496 — Application used wrong group ID causing execution with incorrect privileges.
-
CVE-2004-0274 — Incorrect status assignment resulted in unintended privilege increase.
References
-
MITRE Corporation. "CWE-266: Incorrect Privilege Assignment." Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/266.html
-
OWASP Foundation. "Broken Access Control." OWASP Top 10. https://owasp.org/Top10/A01_2021-Broken_Access_Control/
-
NIST. "Guide to Attribute Based Access Control (ABAC) Definition and Considerations." SP 800-162. https://csrc.nist.gov/publications/detail/sp/800-162/final