id: linux-world-writable-file

info:
  name: Linux World-Writable File Permission
  author: songyaeji
  severity: high
  description: |
    System files were configured with world-writable (chmod o+w) permissions.Malicious users could modify them, leading to privilege escalation, backdoors, or service disruption.
  reference:
    - https://isms.kisa.or.kr
  tags: linux,audit,compliance,kisa

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      find / -type f -perm -0002 ! -path "/tmp/*" -exec ls -l {} \; 2>/dev/null

    matchers:
      - type: regex
        name: world-writable-files
        part: response
        regex:
          - "^-........w.*"
# digest: 4a0a0047304502201fdb2ec6eeef40f7f441baee930f0596bd3713f35ff6ef209593aa76d8884ce1022100995e9e7812db0a19d32d845fea52ba446712f191ab392fc8431c3da39885762c:922c64590222798bb761d5b6d8e72950