Incorrect Execution-Assigned Permissions

Description

Incorrect Execution-Assigned Permissions is a vulnerability that occurs when a product sets object permissions during execution in ways that violate the user's intended specifications. Unlike installation-time permission errors, this weakness manifests when applications dynamically create or modify files, directories, or other objects with permissions that differ from what users or administrators expected. This can occur when applications use hard-coded permission values, ignore user-specified settings, fail to apply proper restrictions to newly created objects, or apply incorrect access controls to runtime-generated resources.

Risk

Runtime permission misassignment creates security vulnerabilities that can be difficult to detect because the incorrect permissions are set during normal operation rather than at installation. Log files created with read/write permissions for all users allow attackers to read sensitive logged information or tamper with logs to hide malicious activity. Temporary files created with overly permissive access expose session data, credentials, or other sensitive runtime information. Configuration files generated during execution may have different permissions than user-created configurations, creating unexpected security gaps. The risk is amplified because these dynamically created objects often contain the most sensitive runtime data.

Solution

Carefully manage permission setting during program execution, explicitly managing trust zones. Before creating files or other objects, determine the minimum required permissions and apply them during creation. Use file creation APIs that accept explicit permission parameters rather than relying on defaults. Implement separation of privilege through system compartmentalization with clear trust boundaries. Apply the principle of least privilege when determining permissions for dynamically created objects. Verify that created objects have the intended permissions by checking after creation. For log files and other sensitive runtime data, ensure permissions prevent unauthorized access even if created by different application components. Respect user-specified permission settings and avoid overriding them with less restrictive defaults.

Common Consequences

Impact	Details
Confidentiality, Integrity	Scope: Confidentiality, Integrity Unauthorized reading of application data exposes sensitive runtime information including logs, session data, and temporary files. Unauthorized modification allows tampering with logs, altering configuration, or injecting malicious content into dynamically created files.

Example Code

Vulnerable Code (C)

The following examples demonstrate incorrect execution-assigned permissions:

// Vulnerable: Log file opened with read/write permissions for all
#include <stdio.h>
#include <fcntl.h>
#include <sys/stat.h>

void vulnerable_create_log(const char *log_path) {
    // Vulnerable: Creates log with world-readable/writable permissions
    int fd = open(log_path, O_WRONLY | O_CREAT | O_APPEND, 0666);
    // Any user can read and write to the log file!

    if (fd >= 0) {
        write(fd, "Application started\n", 20);
        close(fd);
    }
}

void vulnerable_create_temp_file(void) {
    // Vulnerable: Temp file with excessive permissions
    FILE *tmp = fopen("/tmp/app_session.tmp", "w");
    // File created with default permissions (umask-dependent)
    // Likely world-readable

    if (tmp) {
        fprintf(tmp, "session_token=abc123\n");
        fclose(tmp);
    }
}

# Vulnerable: Python runtime permission errors
import os

class VulnerableApplication:

    def create_runtime_config(self, config_data):
        # Vulnerable: No explicit permissions specified
        # Uses default umask which may be permissive
        with open('/var/lib/myapp/runtime.conf', 'w') as f:
            f.write(config_data)
        # Config may contain sensitive settings but be world-readable

    def create_log_directory(self):
        # Vulnerable: Creates log dir with world-writable permissions
        os.makedirs('/var/log/myapp', mode=0o777, exist_ok=True)

        # Individual log files also created too permissively
        log_path = '/var/log/myapp/app.log'
        with open(log_path, 'a') as f:
            f.write("Application initialized\n")
        # Log file world-readable by default

    def save_user_data(self, user_id, data):
        # Vulnerable: User-specific data with wrong permissions
        user_file = f'/var/lib/myapp/users/{user_id}/data.json'
        os.makedirs(os.path.dirname(user_file), exist_ok=True)

        with open(user_file, 'w') as f:
            f.write(data)
        # All user data files have same (wrong) permissions

// Vulnerable: Java runtime file creation
import java.io.*;
import java.nio.file.*;

public class VulnerableRuntimeFiles {

    public void createLogFile(String message) throws IOException {
        // Vulnerable: Default permissions on log file
        FileWriter fw = new FileWriter("/var/log/app/runtime.log", true);
        fw.write(message + "\n");
        fw.close();
        // Log file permissions determined by system defaults
    }

    public void cacheUserSession(String userId, String sessionData) throws IOException {
        Path cachePath = Paths.get("/tmp/app_cache/" + userId + ".session");

        // Vulnerable: No explicit permissions
        Files.createDirectories(cachePath.getParent());
        Files.write(cachePath, sessionData.getBytes());
        // Session data accessible to other users
    }
}

Fixed Code (C)

// Fixed: Proper permissions during execution
#include <stdio.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <unistd.h>

void secure_create_log(const char *log_path) {
    // Set restrictive umask for this operation
    mode_t old_umask = umask(0077);

    // Create log with owner-only write, group-read for log aggregators
    int fd = open(log_path,
                  O_WRONLY | O_CREAT | O_APPEND,
                  S_IRUSR | S_IWUSR | S_IRGRP);  // 0640

    if (fd >= 0) {
        write(fd, "Application started\n", 20);
        close(fd);

        // Verify permissions were set correctly
        struct stat st;
        if (stat(log_path, &st) == 0) {
            if (st.st_mode & S_IWGRP || st.st_mode & S_IROTH) {
                // Permissions too open - fix them
                chmod(log_path, S_IRUSR | S_IWUSR | S_IRGRP);
            }
        }
    }

    umask(old_umask);
}

void secure_create_temp_file(void) {
    char template[] = "/tmp/app_session_XXXXXX";

    // mkstemp creates with 0600 permissions by default
    int fd = mkstemp(template);

    if (fd >= 0) {
        dprintf(fd, "session_token=abc123\n");
        close(fd);
        // Clean up when done
        unlink(template);
    }
}

void secure_create_log_dir(const char *log_dir) {
    // Create directory with appropriate permissions
    if (mkdir(log_dir, 0750) != 0 && errno != EEXIST) {
        // Handle error
        return;
    }

    // Ensure correct permissions even if directory existed
    chmod(log_dir, 0750);

    // Change ownership to log user/group
    struct passwd *log_user = getpwnam("syslog");
    if (log_user) {
        chown(log_dir, log_user->pw_uid, log_user->pw_gid);
    }
}

# Fixed: Python with proper runtime permissions
import os
import stat
import tempfile

class SecureApplication:

    def create_runtime_config(self, config_data):
        config_path = '/var/lib/myapp/runtime.conf'

        # Ensure directory exists with proper permissions
        config_dir = os.path.dirname(config_path)
        os.makedirs(config_dir, mode=0o700, exist_ok=True)

        # Set restrictive umask
        old_umask = os.umask(0o077)
        try:
            # Create file with explicit restrictive permissions
            fd = os.open(config_path,
                        os.O_WRONLY | os.O_CREAT | os.O_TRUNC,
                        0o600)
            try:
                os.write(fd, config_data.encode())
            finally:
                os.close(fd)
        finally:
            os.umask(old_umask)

    def create_log_directory(self):
        log_dir = '/var/log/myapp'
        log_path = os.path.join(log_dir, 'app.log')

        # Create log directory with proper permissions
        os.makedirs(log_dir, mode=0o750, exist_ok=True)

        # Create log file with appropriate permissions
        # Readable by group (for log aggregation), writable by owner
        fd = os.open(log_path,
                    os.O_WRONLY | os.O_CREAT | os.O_APPEND,
                    0o640)
        try:
            os.write(fd, b"Application initialized\n")
        finally:
            os.close(fd)

    def save_user_data(self, user_id, data):
        user_dir = f'/var/lib/myapp/users/{user_id}'
        user_file = os.path.join(user_dir, 'data.json')

        # Create user directory with restrictive permissions
        os.makedirs(user_dir, mode=0o700, exist_ok=True)

        # Save user data with owner-only access
        fd = os.open(user_file, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
        try:
            os.write(fd, data.encode())
        finally:
            os.close(fd)

// Fixed: Java with explicit runtime permissions
import java.io.*;
import java.nio.file.*;
import java.nio.file.attribute.*;
import java.util.*;

public class SecureRuntimeFiles {

    private static final Set<PosixFilePermission> LOG_PERMS =
        PosixFilePermissions.fromString("rw-r-----");  // 640
    private static final Set<PosixFilePermission> SESSION_PERMS =
        PosixFilePermissions.fromString("rw-------");  // 600
    private static final Set<PosixFilePermission> DIR_PERMS =
        PosixFilePermissions.fromString("rwx------");  // 700

    public void createLogFile(String message) throws IOException {
        Path logPath = Paths.get("/var/log/app/runtime.log");

        // Ensure directory exists with proper permissions
        if (!Files.exists(logPath.getParent())) {
            Files.createDirectories(logPath.getParent(),
                PosixFilePermissions.asFileAttribute(
                    PosixFilePermissions.fromString("rwxr-x---")));
        }

        // Write log entry
        Files.write(logPath, (message + "\n").getBytes(),
            StandardOpenOption.CREATE,
            StandardOpenOption.APPEND);

        // Set correct permissions
        Files.setPosixFilePermissions(logPath, LOG_PERMS);
    }

    public void cacheUserSession(String userId, String sessionData) throws IOException {
        Path cacheDir = Paths.get("/tmp/app_cache");
        Path cachePath = cacheDir.resolve(userId + ".session");

        // Create cache directory with restrictive permissions
        if (!Files.exists(cacheDir)) {
            Files.createDirectories(cacheDir,
                PosixFilePermissions.asFileAttribute(DIR_PERMS));
        }

        // Write session data
        Files.write(cachePath, sessionData.getBytes(),
            StandardOpenOption.CREATE,
            StandardOpenOption.TRUNCATE_EXISTING);

        // Set restrictive permissions on session file
        Files.setPosixFilePermissions(cachePath, SESSION_PERMS);
    }
}

The fix ensures all runtime-created objects have explicit, appropriate permissions rather than relying on potentially insecure defaults.

---

Exploited in the Wild

Log File Tampering Attacks (Various Applications, Ongoing)

Applications creating log files with read/write permissions for all users have enabled attackers to both read sensitive logged information and modify logs to hide malicious activity. CVE-2002-0265, CVE-2003-0876, and CVE-2002-1694 documented log files opened with overly permissive read/write permissions.

• https://www.exploit-db.com/

Session File Exposure (Web Applications, Ongoing)

Web applications storing session data in files with incorrect runtime permissions have exposed session tokens and authentication data to local attackers, enabling session hijacking and privilege escalation.

• https://owasp.org/

Temporary File Attacks (Unix/Linux Systems, Historical)

Applications creating temporary files with incorrect permissions have enabled local information disclosure and code injection attacks through symlink exploitation and race conditions.

• https://www.cvedetails.com/

---

Tools to Test/Exploit

• Inotify watchers — Monitor file creation and check permissions of newly created files during application runtime.

• strace — Trace system calls to observe permission arguments in file creation calls.

• Auditd — Linux audit daemon for monitoring file permission changes.

---

CVE Examples

• CVE-2002-0265 — Log files opened with read/write permissions allowing unauthorized access.

• CVE-2003-0876 — Log files created with world-readable/writable permissions.

• CVE-2002-1694 — Runtime log files with incorrect permissions.

---

References

1. MITRE Corporation. "CWE-279: Incorrect Execution-Assigned Permissions." Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/279.html

2. CERT C Secure Coding Standard. "FIO06-C. Create files with appropriate access permissions." https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C

3. CERT Oracle Secure Coding Standard for Java. "FIO01-J. Create files with appropriate access permissions." https://wiki.sei.cmu.edu/confluence/display/java/FIO01-J