OWASP Vulnerability: Missing Function Level Access Control

An example of this vulnerability would be that an unauthorised user is able to access a URL that consists of sensitive data/ information or exposes confidential information intended for only authorized users.

Another example would be to simply hide functionality from the authorized user but at the end allowing the feature if the user figures out how to conduct it. This vulnerability reveals the functionalities rather than information.

Most commonly this vulnerability affects a large number of companies including software development companies and websites of all sizes.

THE VULNERABILITY CAN BE COMPROMISED?

The impact of this vulnerability depends mainly on the kind of features/ information the attacker can gain the access to. It can vary from gaining access to useless data or full system takeover. The user can also gain access to the admin related rights without even getting caught/ known.

Exploitability

Taking advantage of this vulnerability and detecting this is considered very easy. This can happen when the attacker tries to gain access to a specific action on a particular system which requires proper authentication and if the request succeeds, then the page is considered vulnerable to threats. What is difficult is to figure out each page that is at risk. Sometimes it is a part of a chain attack that requires lot of creativity.

For example: If the user intercepts a request to delete its own credit card and he/she was able to change the id of that card and with this the user deleted another user’s account by mistake. This could lead to a considerable damage to the business.

How to discover the vulnerability

One way is to browse the website while it is logged it and logs all pages as visited. Next log out the website and then revisit the pages again. If you get the same result again then it proves that the vulnerability exists

Another way can be to identify usernames and similar info in requests and someone can easily change it. 

AFFECTED ITEMS AND SEVERITY

Severity: moderate

The business value of the revealed functions and the data is compromised. And the impact to your reputation also creates a bad impact on the market.

RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS)

• There should be denial of access to various confidential data/ information/ system.
• Every specific application should have role based access to its authorized system. It is also advisable to have a log of all failed attempt so that this may help to discover if something malicious has happened.
• Blocking access to all file types prevent a great way to prevent an attacker for accessing any sensitive information, databases, log files etc Do not assume that the users are not aware of the hidden URL or API.
• Verifying the users before allowing them to access resources.
• Your application should have an easy way to analyze the authorization module.
• If the function is involved in a proper workflow then ensure that the conditions are in proper state.
• Also implement checks in business logic and controller.