CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
How it's found
Files or Directories Accessible to External Parties is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories. In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.
Vulnerable vs. safe
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access trueaz storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access falseConsequences
- Read Files or Directories, Modify Files or Directories
Mitigations
- Implementation/System Configuration/Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-552?
The product makes files or directories accessible to unauthorized actors, even though they should not be.
How do you find Files or Directories Accessible to External Parties?
Files or Directories Accessible to External Parties is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-552?
Read Files or Directories, Modify Files or Directories
Does TurboPentest test for Files or Directories Accessible to External Parties?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
- Class weaknessCWE-668: Exposure of Resource to Wrong Sphere
- Class weaknessCWE-285: Improper Authorization
- Base weaknessCWE-209: Generation of Error Message Containing Sensitive Information
- Base weaknessCWE-215: Insertion of Sensitive Information Into Debugging Code
- Variant weaknessCWE-219: Storage of File with Sensitive Data Under Web Root
- Base weaknessCWE-295: Improper Certificate Validation
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest