CWE-277 (不安全的继承权限) — Vulnerability Class 23

CWE-277 represents a critical access control weakness where a software application assigns overly permissive security attributes to newly created objects, such as files or directories, which are then inherited by child entities. Attackers typically exploit this flaw by creating a malicious file or directory that inherits these excessive privileges, allowing unauthorized users to read, modify, or execute sensitive data without proper authentication. This vulnerability often arises when developers rely on default system permissions rather than explicitly defining restrictive access controls during object creation. To mitigate this risk, developers must implement the principle of least privilege by explicitly setting secure, minimal permissions for all new resources. Additionally, utilizing secure coding practices that override default inheritance settings and regularly auditing file system permissions can prevent accidental exposure of sensitive information to untrusted actors.