The principle of least privilege states that every program and every user of the system should operate using the least set of privileges necessary to complete the job [Saltzer 1974, Saltzer 1975]. The Build Security In website [DHS 2006] provides additional definitions of this principle. Executing with minimal privileges mitigates against exploitation in case a vulnerability is discovered in the code.
Noncompliant Code Example
An application may spawn another process as part of its normal course of action. On Windows, the newly-spawned process automatically receives the same privileges as the parent process [MSDN]. By allowing the child process to run in the same security context as the parent process, the attack surface for the application is extended to the child process. Furthermore, this example allows the child process to inherit handles from the parent process by passing TRUE to the bInheritsHandles parameter.
...
It is possible that the act of calling launch_notepad() will give the user an elevated Notepad application (from which the user could execute Explorer.exe), allowing them access to all user's files, change system settings, etc.
Compliant Solution
By using the Windows Integrity Mechanism [MSDN] when creating the process, you can assign an integrity level to the launched child process. This allows you to execute the child process with a specific set of privileges instead of defaulting to the parent process' security level.
...
| Integrity level SID | Name |
|---|---|
S-1-16-4096 | Mandatory Label\Low Mandatory Level |
S-1-16-8192 | Mandatory Label\Medium Mandatory Level |
S-1-16-12288 | Mandatory Label\High Mandatory Level |
S-1-16-16384 | Mandatory Label\System Mandatory Level |
Risk Assessment
Failure to follow the principle of least privilege may allow exploits to execute with elevated privileges.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
WIN01-C | high | likely | high | P9 | L2 |
Related Guidelines
| ISO/IEC TR 24772 | Adherence to Least Privilege [XYN] |
| MITRE CWE | CWE-250, Execution with unnecessary privileges CWE-272, Least privilege violation |