Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.
CWE-560 Variant Draft
Use of umask() with chmod-style Argument
This vulnerability occurs when a program incorrectly uses the `umask()` system call with an argument formatted for `chmod()`, leading to unintended and overly permissive file permissions.
Definition
What is CWE-560?
This vulnerability occurs when a program incorrectly uses the `umask()` system call with an argument formatted for `chmod()`, leading to unintended and overly permissive file permissions.
The `umask()` function sets a process's file mode creation mask, which restricts permissions on newly created files. However, developers sometimes mistakenly pass it an octal value (like 0644 or 0777) intended for `chmod()`, which sets permissions directly. Since `umask()` interprets its argument as a mask that *blocks* permissions, this inversion results in files being created with far more access than intended, potentially exposing sensitive data.
For example, passing `umask(0)` (a common `chmod`-style intent to grant all permissions) actually creates a mask of zero, meaning no permissions are blocked. This causes new files to be created with full read, write, and execute access for all users. The core issue is a semantic confusion between a mask that subtracts permissions (`umask`) and a mode that adds them (`chmod`), a mistake that directly weakens file system security.
Real-world impact
Real-world CVEs caused by CWE-560
No public CVE references are linked to this CWE in MITRE's catalog yet.
How attackers exploit it
Step-by-step attacker path
- 1
Identify a code path that handles untrusted input without validation.
- 2
Craft a payload that exercises the unsafe behavior — injection, traversal, overflow, or logic abuse.
- 3
Deliver the payload through a normal request and observe the application's reaction.
- 4
Iterate until the response leaks data, executes attacker code, or escalates privileges.
Vulnerable code example
Vulnerable pseudo
MITRE has not published a code example for this CWE. The pattern below is illustrative — see Resources for canonical references.
// Example pattern — see MITRE for the canonical references.
function handleRequest(input) {
// Untrusted input flows directly into the sensitive sink.
return executeUnsafe(input);
} Secure code example
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist
How to prevent CWE-560
- Implementation Use umask() with the correct argument.
- Testing If you suspect misuse of umask(), you can use grep to spot call instances of umask().
Detection signals
How to detect CWE-560
Run dynamic application security testing against the live endpoint.
Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.
Code review: flag any new code that handles input from this surface without using the validated framework helpers.
CWE-560
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Frequently asked questions What is CWE-560?
How serious is CWE-560?
What languages or platforms are affected by CWE-560?
How can I prevent CWE-560?
How does Plexicus detect and fix CWE-560?
Where can I learn more about CWE-560?
Frequently asked questions
What is CWE-560?
This vulnerability occurs when a program incorrectly uses the `umask()` system call with an argument formatted for `chmod()`, leading to unintended and overly permissive file permissions.
How serious is CWE-560?
MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.
What languages or platforms are affected by CWE-560?
MITRE lists the following affected platforms: C.
How can I prevent CWE-560?
Use umask() with the correct argument. If you suspect misuse of umask(), you can use grep to spot call instances of umask().
How does Plexicus detect and fix CWE-560?
Plexicus's SAST engine matches the data-flow signature for CWE-560 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.
Where can I learn more about CWE-560?
MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/560.html. You can also reference OWASP and NIST documentation for adjacent guidance.
Ready to validate what matters?
Ready to validate what matters?
Plexicus is Proof-Driven AppSec: validated findings, contextual understanding, and reviewed remediation — anchored in evidence, scoped with you.