Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
When privileges are not properly managed, users may gain access to resources or functionality they should not have. This includes privilege escalation and improper role assignment.
보급률
높음
자주 악용됨
영향
높음
2개의 높은 심각도 규칙
예방
문서화됨
2개의 수정 예시
2 예방
2 예방
이 취약점을 수정하는 방법
Python
모두 보기 Python 자세히 →
Default Privilege Assignment in User Creation
HIGH
Create users with least-privilege defaults and require explicit admin action for privilege elevation
def register(request): data = request.get_json() - user = User.objects.create( - username=data['username'], - email=data['email'], - is_staff=True, + user = User.objects.create_user( + username=data['username'], + email=data['email'], + password=data['password'], ) return {'status': 'created'}
Missing Role/Permission Checks
HIGH
Use permission decorators to verify user roles before any privilege modification
- from django.http import JsonResponse - from django.contrib.auth.models import User - + from django.contrib.auth.decorators import permission_required + from django.http import JsonResponse + from django.contrib.auth.models import User + + @permission_required('auth.change_user', raise_exception=True) def promote_user(request, user_id): user = User.objects.get(id=user_id) user.is_staff = True user.save() return JsonResponse({'status': 'promoted'})
3 탐지
3 탐지
코드에서 취약점 찾기
Shoulder를 사용하여 코드에서 Improper Privilege Management 패턴을 스캔하세요. 2 규칙.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=269 # Or scan entire project npx @shoulderdev/cli trust .
4 경고 신호
4 경고 신호
코드 리뷰에서 주의할 점
이 패턴은 잠재적인 Improper Privilege Management 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.
user creation flows that assign elevated privileges by default
python-default-privilege-assignment
privileged operations like role modification without verifying user permissions
python-privilege-escalation
코드베이스를 스캔하세요: Improper Privilege Management
Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.