×
iFour Logo

OWASP Vulnerability: Missing Function Level Access Control

iFour Team - August 04, 2017

Listening is fun too.

Straighten your back and cherish with coffee - PLAY !

OWASP Vulnerability

An example of this vulnerability would be that an unauthorised user is able to access a URL that consists of sensitive data/ information or exposes confidential information intended for only authorized users.

Another example would be to simply hide functionality from the authorized user but at the end allowing the feature if the user figures out how to conduct it. This vulnerability reveals the functionalities rather than information.

 

Table of Content

Most commonly this vulnerability affects a large number of companies including software development companies and websites of all sizes.

THE VULNERABILITY CAN BE COMPROMISED?

The impact of this vulnerability depends mainly on the kind of features/ information the attacker can gain the access to. It can vary from gaining access to useless data or full system takeover. The user can also gain access to the admin related rights without even getting caught/ known.

Exploitability

Taking advantage of this vulnerability and detecting this is considered very easy. This can happen when the attacker tries to gain access to a specific action on a particular system which requires proper authentication and if the request succeeds, then the page is considered vulnerable to threats. What is difficult is to figure out each page that is at risk. Sometimes it is a part of a chain attack that requires lot of creativity.

For example: If the user intercepts a request to delete its own credit card and he/she was able to change the id of that card and with this the user deleted another user’s account by mistake. This could lead to a considerable damage to the business.

How to discover the vulnerability

One way is to browse the website while it is logged it and logs all pages as visited. Next log out the website and then revisit the pages again. If you get the same result again then it proves that the vulnerability exists Another way can be to identify usernames and similar info in requests and someone can easily change it.

AFFECTED ITEMS AND SEVERITY

Severity: moderate
The business value of the revealed functions and the data is compromised. And the impact to your reputation also creates a bad impact on the market.

RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS)

 

  • There should be denial of access to various confidential data/ information/ system.

  • Every specific application should have role based access to its authorized system. It is also advisable to have a log of all failed attempt so that this may help to discover if something malicious has happened.

  • Blocking access to all file types prevent a great way to prevent an attacker for accessing any sensitive information, databases, log files etc Do not assume that the users are not aware of the hidden URL or API.

  • Verifying the users before allowing them to access resources.

  • Your application should have an easy way to analyze the authorization module.

  • If the function is involved in a proper workflow then ensure that the conditions are in proper state.

  • Also implement checks in business logic and controller.

Looking to Hire Hire MVC Development Company? Contact Now

OWASP Vulnerability: Missing Function Level Access Control An example of this vulnerability would be that an unauthorised user is able to access a URL that consists of sensitive data/ information or exposes confidential information intended for only authorized users. Another example would be to simply hide functionality from the authorized user but at the end allowing the feature if the user figures out how to conduct it. This vulnerability reveals the functionalities rather than information.   Table of Content 1. THE VULNERABILITY CAN BE COMPROMISED? 2. Exploitability 3. How to discover the vulnerability 4.AFFECTED ITEMS AND SEVERITY 5. RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS) Most commonly this vulnerability affects a large number of companies including software development companies and websites of all sizes. THE VULNERABILITY CAN BE COMPROMISED? The impact of this vulnerability depends mainly on the kind of features/ information the attacker can gain the access to. It can vary from gaining access to useless data or full system takeover. The user can also gain access to the admin related rights without even getting caught/ known. Exploitability Taking advantage of this vulnerability and detecting this is considered very easy. This can happen when the attacker tries to gain access to a specific action on a particular system which requires proper authentication and if the request succeeds, then the page is considered vulnerable to threats. What is difficult is to figure out each page that is at risk. Sometimes it is a part of a chain attack that requires lot of creativity. Read More: Owasp Vulnerability: Sql Injection For example: If the user intercepts a request to delete its own credit card and he/she was able to change the id of that card and with this the user deleted another user’s account by mistake. This could lead to a considerable damage to the business. How to discover the vulnerability One way is to browse the website while it is logged it and logs all pages as visited. Next log out the website and then revisit the pages again. If you get the same result again then it proves that the vulnerability exists Another way can be to identify usernames and similar info in requests and someone can easily change it. AFFECTED ITEMS AND SEVERITY Severity: moderate The business value of the revealed functions and the data is compromised. And the impact to your reputation also creates a bad impact on the market. RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS)   There should be denial of access to various confidential data/ information/ system. Every specific application should have role based access to its authorized system. It is also advisable to have a log of all failed attempt so that this may help to discover if something malicious has happened. Blocking access to all file types prevent a great way to prevent an attacker for accessing any sensitive information, databases, log files etc Do not assume that the users are not aware of the hidden URL or API. Verifying the users before allowing them to access resources. Your application should have an easy way to analyze the authorization module. If the function is involved in a proper workflow then ensure that the conditions are in proper state. Also implement checks in business logic and controller. Looking to Hire Hire MVC Development Company? Contact Now See here

Categories

Ensure your sustainable growth with our team

Talk to our experts
Sustainable
Sustainable
 

Blog Our insights

What are the concerns faced while developing Fitness management software?
What are the concerns faced while developing Fitness management software?

Table of Content 1.Explaining vision to folklores 2.Changing the habits of end users 3.Conflicts with team members 4.The issue of cyber security 5.Identifying issues...

How Blockchain can impact the Financial industry in 2023?
How Blockchain can impact the Financial industry in 2023?

Table of Content 1.Boosts payment transparency, trust, and efficiency 2.Reduces operational risks and enables real-time verification 3.Eliminates central authority to...

How to create a user-friendly E-commerce store? Tips and Motives for 2023
How to create a user-friendly E-commerce store? Tips and Motives for 2023

Table of Content 1.What is user-friendliness in terms of an eCommerce store? 2.Accessibility 3.Mobile compatibility and responsiveness 4.Easy-to-find information and...