×

iFour Logo

OWASP Vulnerability: Missing Function Level Access Control

iFour Team August 04, 2017

Listening is fun too.

Straighten your back and cherish with coffee - PLAY !

  • play
  • pause
  • pause
OWASP Vulnerability: Missing Function Level Access Control

An example of this vulnerability would be that an unauthorised user is able to access a URL that consists of sensitive data/ information or exposes confidential information intended for only authorized users.

Another example would be to simply hide functionality from the authorized user but at the end allowing the feature if the user figures out how to conduct it. This vulnerability reveals the functionalities rather than information.

Most commonly this vulnerability affects a large number of companies including software development companies and websites of all sizes.

THE VULNERABILITY CAN BE COMPROMISED?


The impact of this vulnerability depends mainly on the kind of features/ information the attacker can gain the access to. It can vary from gaining access to useless data or full system takeover. The user can also gain access to the admin related rights without even getting caught/ known.

Exploitability


Taking advantage of this vulnerability and detecting this is considered very easy. This can happen when the attacker tries to gain access to a specific action on a particular system which requires proper authentication and if the request succeeds, then the page is considered vulnerable to threats. What is difficult is to figure out each page that is at risk. Sometimes it is a part of a chain attack that requires lot of creativity.

For example: If the user intercepts a request to delete its own credit card and he/she was able to change the id of that card and with this the user deleted another user’s account by mistake. This could lead to a considerable damage to the business.

How to discover the vulnerability


One way is to browse the website while it is logged it and logs all pages as visited. Next log out the website and then revisit the pages again. If you get the same result again then it proves that the vulnerability exists Another way can be to identify usernames and similar info in requests and someone can easily change it.

AFFECTED ITEMS AND SEVERITY


Severity: moderate
The business value of the revealed functions and the data is compromised. And the impact to your reputation also creates a bad impact on the market.

RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS)


 

  • There should be denial of access to various confidential data/ information/ system.

  • Every specific application should have role based access to its authorized system. It is also advisable to have a log of all failed attempt so that this may help to discover if something malicious has happened.

  • Blocking access to all file types prevent a great way to prevent an attacker for accessing any sensitive information, databases, log files etc Do not assume that the users are not aware of the hidden URL or API.

  • Verifying the users before allowing them to access resources.

  • Your application should have an easy way to analyze the authorization module.

  • If the function is involved in a proper workflow then ensure that the conditions are in proper state.

  • Also implement checks in business logic and controller.

Looking to Hire Hire MVC Development Company? Contact Now

OWASP Vulnerability: Missing Function Level Access Control An example of this vulnerability would be that an unauthorised user is able to access a URL that consists of sensitive data/ information or exposes confidential information intended for only authorized users. Another example would be to simply hide functionality from the authorized user but at the end allowing the feature if the user figures out how to conduct it. This vulnerability reveals the functionalities rather than information. Most commonly this vulnerability affects a large number of companies including software development companies and websites of all sizes. THE VULNERABILITY CAN BE COMPROMISED? The impact of this vulnerability depends mainly on the kind of features/ information the attacker can gain the access to. It can vary from gaining access to useless data or full system takeover. The user can also gain access to the admin related rights without even getting caught/ known. Exploitability Taking advantage of this vulnerability and detecting this is considered very easy. This can happen when the attacker tries to gain access to a specific action on a particular system which requires proper authentication and if the request succeeds, then the page is considered vulnerable to threats. What is difficult is to figure out each page that is at risk. Sometimes it is a part of a chain attack that requires lot of creativity. Read More: Owasp Vulnerability: Sql Injection For example: If the user intercepts a request to delete its own credit card and he/she was able to change the id of that card and with this the user deleted another user’s account by mistake. This could lead to a considerable damage to the business. How to discover the vulnerability One way is to browse the website while it is logged it and logs all pages as visited. Next log out the website and then revisit the pages again. If you get the same result again then it proves that the vulnerability exists Another way can be to identify usernames and similar info in requests and someone can easily change it. AFFECTED ITEMS AND SEVERITY Severity: moderate The business value of the revealed functions and the data is compromised. And the impact to your reputation also creates a bad impact on the market. RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS)   There should be denial of access to various confidential data/ information/ system. Every specific application should have role based access to its authorized system. It is also advisable to have a log of all failed attempt so that this may help to discover if something malicious has happened. Blocking access to all file types prevent a great way to prevent an attacker for accessing any sensitive information, databases, log files etc Do not assume that the users are not aware of the hidden URL or API. Verifying the users before allowing them to access resources. Your application should have an easy way to analyze the authorization module. If the function is involved in a proper workflow then ensure that the conditions are in proper state. Also implement checks in business logic and controller. Looking to Hire Hire MVC Development Company? Contact Now See here

Build Your Agile Team

Categories

Ensure your sustainable growth with our team

Talk to our experts
Sustainable
Sustainable
 
Blog Our insights
How CFOs benefit from AI-Powered Finance using Dynamics 365

14 July 2025

Lochan Paliwal

How CFOs benefit from AI-Powered Finance using Dynamics 365

Many finance teams struggle with manual processes, late reporting, and a lack of real-time data. Before adopting AI-powered Dynamics 365 Finance, CFOs frequently faced disconnected systems, unproductive workflows, and limited forecasting accuracy.

Microsoft 365 Copilot in Finance: Top 7 Use Cases

19 June 2025

Kapil Panchal

Microsoft 365 Copilot in Finance: Top 7 Use Cases

AI and Automation aren’t just options anymore. They are a necessity to keep yourself focused on what matters the most. Whether it is Zapier or Power Automate, ChatGPT or Copilot, every...

Azure AI Foundry Use Cases (Real-World Azure Cloud Success Stories)

29 May 2025

Kapil Panchal

Azure AI Foundry Use Cases (Real-World Azure Cloud Success Stories)

AI is everywhere now. Companies use it to handle customer questions, process accounts and even make real decisions that professionals used to spend hours on. What took days now happens...