Description

This vulnerability detector identifies insecure file permissions in Elixir code. It detects when chmod-like functions are called with overly permissive file mode values that could expose sensitive files to unauthorized access, potentially allowing attackers to read, modify, or execute critical system or application files.

Detection Strategy

• Scans Elixir source code for function calls that modify file permissions (chmod operations)

• Identifies when these file permission functions are called with a second argument (the file mode parameter)

• Analyzes the file mode value to determine if it grants excessive permissions

• Reports a vulnerability when the file mode allows overly permissive access that could compromise file security

Vulnerable code example

defmodule VulnerablePermissions do
  @unsafe_file 0o666

  def create_file() do
    File.write!("secret.txt", "data")
    # VULNERABLE: File becomes world-readable and world-writable
    File.chmod("secret.txt", 0o666)
  end...

✅ Secure code example

defmodule VulnerablePermissions do
  @safe_file 0o600  # Only owner can read/write

  def create_file() do
    File.write!("secret.txt", "data")
    # SECURE: Only owner can access the file
    File.chmod("secret.txt", 0o600)
  end...