बीटा Shoulder बीटा में है — परिणाम कभी-कभी गलत हो सकते हैं। आपकी प्रतिक्रिया तय करती है कि हम आगे क्या ठीक करें। प्रतिक्रिया साझा करें
Shoulder.dev

डेवलपर सुरक्षा प्लेटफ़ॉर्म
🔒

Execution with Unnecessary Privileges

🛡️ 10 नियम इसे पहचानते हैं

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

New weaknesses can be exposed because running with extra privileges gives the product access to resources that are not necessary. In addition, if an attacker can trigger the operation with the higher privileges, the attacker might gain root or administrator privileges.

व्यापकता
उच्च
बार-बार शोषित
प्रभाव
क्रिटिकल
3 क्रिटिकल गंभीरता वाले नियम
रोकथाम
प्रलेखित
10 फिक्स उदाहरण
2 रोकथाम
2 रोकथाम

इस भेद्यता को कैसे ठीक करें

🐳 Docker सब देखें Docker विवरण →
Container runs as root HIGH

Add a USER instruction before CMD/ENTRYPOINT to run as non-root

+2 -0 dockerfile 
  FROM node:24-alpine
  WORKDIR /app
  COPY . .
  RUN npm ci
+ RUN addgroup -S appuser && adduser -S appuser -G appuser
+ USER appuser
  CMD ["node", "server.js"]
Docker User and File Permissions HIGH

Use a non-root user and restrictive file permissions instead of USER root or chmod 777

+5 -3 dockerfile 
  FROM node:24-alpine
- USER root
- RUN chmod 777 /app
- COPY . /app
+ RUN addgroup -S appuser && adduser -S appuser -G appuser
+ WORKDIR /app
+ COPY --chown=appuser:appuser . .
+ RUN chmod 755 /app
+ USER appuser
  CMD ["node", "server.js"]
☸️ Kubernetes सब देखें Kubernetes विवरण →
Privilege Escalation Allowed HIGH

Set allowPrivilegeEscalation: false to prevent containers from gaining additional privileges

+1 -1 yaml 
  apiVersion: v1
  kind: Pod
  spec:
    containers:
    - name: app
      image: nginx:1.25
      securityContext:
-       allowPrivilegeEscalation: true
+       allowPrivilegeEscalation: false
Dangerous Linux Capabilities Added CRITICAL

Remove dangerous capabilities like SYS_ADMIN, NET_ADMIN, SYS_PTRACE and drop ALL instead

+4 -3 yaml 
  apiVersion: v1
  kind: Pod
  spec:
    containers:
    - name: app
      image: nginx:1.25
      securityContext:
        capabilities:
-         add:
-           - SYS_ADMIN
-           - NET_ADMIN
+         drop:
+           - ALL
+         add:
+           - NET_BIND_SERVICE
Host Namespace Access Enabled CRITICAL

Disable host namespace access (hostNetwork, hostPID, hostIPC) to isolate pods from the host

+3 -2 yaml 
  apiVersion: v1
  kind: Pod
  spec:
-   hostNetwork: true
-   hostPID: true
+   hostNetwork: false
+   hostPID: false
+   hostIPC: false
    containers:
    - name: app
      image: nginx:1.25
3 पहचान
3 पहचान

अपने कोड में भेद्यताएँ खोजें

Execution with Unnecessary Privileges पैटर्न के लिए अपने कोडबेस को स्कैन करने के लिए Shoulder का उपयोग करें। 10 नियम.

टर्मिनल
# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=250

# Or scan entire project
npx @shoulderdev/cli trust .

पहचान नियम (10)

4 चेतावनी संकेत
4 चेतावनी संकेत

कोड समीक्षा में किन बातों पर ध्यान दें

ये पैटर्न संभावित Execution with Unnecessary Privileges भेद्यताओं का संकेत देते हैं। कोड समीक्षा और सुरक्षा ऑडिट के दौरान इन्हें देखें।

🟠
No USER instruction before CMD/ENTRYPOINT - container runs as root docker-missing-user
🟠
CMD or ENTRYPOINT without a preceding USER instruction docker-missing-user
🟠
Dockerfile contains ...: ... docker-user-permissions
🟠
explicit root user and overly permissive chmod 777 permissions docker-user-permissions
🟠
Container allows privilege escalation, which can enable attackers to gain additional privileges through exploits. kubernetes-allow-privilege-escalation
🟠
containers with privilege escalation explicitly enabled kubernetes-allow-privilege-escalation
🟠
Containers should run with security constraints defined in securityContext. kubernetes-missing-security-context
🟠
containers without securityContext configuration kubernetes-missing-security-context
🔍

अपने कोडबेस को इसके लिए स्कैन करें: Execution with Unnecessary Privileges

Shoulder CLI आपके पूरे कोडबेस में भेद्य पैटर्न खोजता है।

npx shoulder trust सभी नियम देखें