code/linux/audit/linux-world-writable-file.yaml

id: linux-world-writable-file

info:
  name: Linux World-Writable File Permission
  author: songyaeji
  severity: high
  description: |
    System files were configured with world-writable (chmod o+w) permissions.Malicious users could modify them, leading to privilege escalation, backdoors, or service disruption.
  reference:
    - https://isms.kisa.or.kr
  tags: linux,audit,compliance,kisa

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      find / -type f -perm -0002 ! -path "/tmp/*" -exec ls -l {} \; 2>/dev/null

    matchers:
      - type: regex
        name: world-writable-files
        part: response
        regex:
          - "^-........w.*"
# digest: 4a0a0047304502201fdb2ec6eeef40f7f441baee930f0596bd3713f35ff6ef209593aa76d8884ce1022100995e9e7812db0a19d32d845fea52ba446712f191ab392fc8431c3da39885762c:922c64590222798bb761d5b6d8e72950
Update & Dir changes 2025-08-25 20:46:27 +05:30			`id: linux-world-writable-file`

			`info:`
			`name: Linux World-Writable File Permission`
			`author: songyaeji`
			`severity: high`
			`description: \|`
			`System files were configured with world-writable (chmod o+w) permissions.Malicious users could modify them, leading to privilege escalation, backdoors, or service disruption.`
			`reference:`
			`- https://isms.kisa.or.kr`
			`tags: linux,audit,compliance,kisa`

			`self-contained: true`

			`code:`
			`- engine:`
			`- sh`
			`- bash`
			`source: \|`
			`find / -type f -perm -0002 ! -path "/tmp/*" -exec ls -l {} \; 2>/dev/null`

			`matchers:`
			`- type: regex`
			`name: world-writable-files`
			`part: response`
			`regex:`
chore: sign templates 🤖 2025-08-27 03:24:08 +00:00			`- "^-........w.*"`
			`# digest: 4a0a0047304502201fdb2ec6eeef40f7f441baee930f0596bd3713f35ff6ef209593aa76d8884ce1022100995e9e7812db0a19d32d845fea52ba446712f191ab392fc8431c3da39885762c:922c64590222798bb761d5b6d8e72950`