What MITRE CWE-732 - Incorrect Permission Assignment for Critical Resource requires
CWE-732 (Incorrect Permission Assignment for Critical Resource) is a CWE Top 25 weakness consistently present in cloud misconfiguration incidents (public S3 buckets, world-readable Kubernetes secrets, public Elasticsearch instances) and operating system file permission flaws. CWE-732 is defined as: the product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. The Extended Description notes that when resources receive overly permissive settings, unintended parties can access sensitive information or make unauthorized modifications; this proves especially hazardous for configuration files, executables, or user data; a misconfigured cloud storage account readable by anonymous users exemplifies this vulnerability. Common Consequences include confidentiality impact (attackers may read sensitive data like credentials or configuration information from improperly secured resources); access control impact (adversaries could modify critical resource properties to escalate privileges, such as replacing executable files with malicious code); and integrity impact (attackers may destroy or corrupt critical data stored in inadequately protected resources, including database records). Potential Mitigations include verifying critical resources lack insecure permissions during startup and generating errors if unauthorized modification is possible; dividing software into distinct user groups with corresponding privilege levels and mapped resource permissions; executing code within sandbox environments (chroot, AppArmor, SELinux) to restrict file and command access; setting restrictive default permissions and umask values at program initialization and installation; restricting configuration files and executables to administrator read/write access only; and disabling public access for cloud storage (S3, Azure, Google Cloud Storage) using provider controls.
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/732.html
SHA-256 integrity: d309808c6c7c2898b2f3eb4efb0bbf6f5a08914a604e9658b6e44c1dc179691b
Primary Citations — 10 traced to source
- CWE-732: Incorrect Permission Assignment for Critical Resource - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/732.html
- CWE-732 Definition - the product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors
+ 8 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access