Back to Vulnerability Database

Incorrect Default Permissions

Description

Incorrect Default Permissions occurs when software installs files, directories, or other resources with permissions that are more permissive than necessary, exposing them to unintended actors. Common manifestations include world-writable executables, configuration files readable by all users, and directories with overly permissive access. When critical files have incorrect permissions, local attackers can read sensitive data, modify executables to inject malicious code, or escalate privileges by exploiting setuid/setgid binaries with weak permissions.

Risk

Incorrect default permissions are a significant source of local privilege escalation vulnerabilities. World-writable executables allow any local user to inject malicious code that runs with the file owner's privileges. Configuration files with sensitive credentials become accessible to unauthorized users. In multi-tenant environments, improper permissions enable cross-tenant data access. Setuid/setgid programs with weak permissions are particularly dangerous—attackers can modify them to execute arbitrary code with elevated privileges. This vulnerability class has been exploited in numerous privilege escalation attacks across Windows, Linux, and macOS systems.

Solution

Apply principle of least privilege to all file and directory permissions. Set restrictive permissions during installation—files should only be readable/writable/executable by intended users. Never set world-writable permissions on executables. Use appropriate umask values during installation. For configuration files containing credentials, restrict access to the owning service account only. Regularly audit file permissions for configuration drift. Use security benchmarks (CIS) for platform-specific permission guidance. Test installations with permission-checking tools.

Common Consequences

ImpactDetails
ConfidentialityScope: Information Disclosure

Overly permissive read permissions expose sensitive data including credentials, keys, and configuration details.
IntegrityScope: Code Injection

Writable permissions on executables allow attackers to inject malicious code executed with the file owner's privileges.
Access ControlScope: Privilege Escalation

Modifying setuid/setgid binaries or configuration files enables privilege escalation to root/Administrator.

Example Code + Solution Code

Vulnerable Code

# VULNERABLE: Installation script with world-writable permissions
#!/bin/bash
mkdir -p /opt/myapp
cp myapp /opt/myapp/
cp config.ini /opt/myapp/

# World-writable executable - any user can modify!
chmod 777 /opt/myapp/myapp

# World-readable config with credentials
chmod 644 /opt/myapp/config.ini
# Config contains: DB_PASSWORD=secret123

# VULNERABLE: Creating files with insecure permissions
import os

def save_credentials(username, password):
    # Default umask may create world-readable file
    with open('/etc/myapp/credentials', 'w') as f:
        f.write(f"{username}:{password}")
    # File is readable by everyone!

def create_log_directory():
    # World-writable directory - symlink attacks possible
    os.makedirs('/var/log/myapp', mode=0o777, exist_ok=True)

// VULNERABLE: Creating setuid binary with weak permissions
#include <sys/stat.h>

int install_helper() {
    // Copy binary
    copy_file("helper", "/usr/local/bin/helper");

    // Set setuid bit BUT permissions allow world-write!
    chmod("/usr/local/bin/helper", S_ISUID | S_IRWXU | S_IRWXG | S_IRWXO);
    // Any user can now modify this setuid binary!

    return 0;
}

Fixed Code

# SAFE: Restrictive permissions
#!/bin/bash

# Create directory with restricted permissions
install -d -m 755 -o root -g root /opt/myapp

# Executable: owner execute, no write for others
install -m 755 -o root -g root myapp /opt/myapp/

# Config with credentials: owner-only
install -m 600 -o myapp -g myapp config.ini /opt/myapp/

# Verify permissions
ls -la /opt/myapp/

import os
import stat

# SAFE: Restrictive file creation
def save_credentials(username, password):
    filepath = '/etc/myapp/credentials'

    # Create directory with restricted permissions
    os.makedirs('/etc/myapp', mode=0o700, exist_ok=True)

    # Set restrictive umask before creating file
    old_umask = os.umask(0o077)
    try:
        with open(filepath, 'w') as f:
            f.write(f"{username}:{password}")
    finally:
        os.umask(old_umask)

    # Verify and enforce permissions
    os.chmod(filepath, stat.S_IRUSR | stat.S_IWUSR)  # 0600

def create_log_directory():
    # Directory writable only by owner
    os.makedirs('/var/log/myapp', mode=0o755, exist_ok=True)
    # Log files should be append-only for service user

#include <sys/stat.h>
#include <unistd.h>

// SAFE: Proper setuid binary installation
int install_helper_safe() {
    const char *path = "/usr/local/bin/helper";

    // Copy binary
    copy_file("helper", path);

    // Set proper ownership first
    chown(path, 0, 0);  // root:root

    // Setuid with NO write permissions for group/other
    // S_ISUID | S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH = 4755
    chmod(path, S_ISUID | S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);

    // Verify permissions
    struct stat st;
    stat(path, &st);
    if (st.st_mode & S_IWGRP || st.st_mode & S_IWOTH) {
        // Still writable - fail installation
        unlink(path);
        return -1;
    }

    return 0;
}

Exploited in the Wild

BackTrack Linux btinstall (BackTrack, 2012)

CVE-2012-5697 in BackTrack Linux's installation script set world-writable permissions on all files in /frameworkgui/, allowing local privilege escalation.

Schneider Electric Harmony/Magelis (Industrial, 2021)

CVE-2021-22817 in Schneider Electric industrial PC series allowed unauthorized access due to incorrect default permissions on the base installation directory.

Samsung Mobile Firmware (Samsung, 2025)

Critical vulnerabilities in Samsung Mobile Firmware related to incorrect default permissions, with zero-day exploits published.

Tools to test/exploit

  • LinPEAS — enumerate misconfigured permissions on Linux.

  • WinPEAS — enumerate weak permissions on Windows.

  • unix-privesc-check — audit UNIX file permissions.

CVE Examples

References

  1. MITRE. "CWE-276: Incorrect Default Permissions." https://cwe.mitre.org/data/definitions/276.html

  2. CIS Benchmarks. "File Permission Guidelines." https://www.cisecurity.org/benchmark/