×

iFour Logo

OWASP Vulnerability: Missing Function Level Access Control

iFour Team - August 04, 2017

Listening is fun too.

Straighten your back and cherish with coffee - PLAY !

  • play
  • pause
  • pause
OWASP Vulnerability

An example of this vulnerability would be that an unauthorised user is able to access a URL that consists of sensitive data/ information or exposes confidential information intended for only authorized users.

Another example would be to simply hide functionality from the authorized user but at the end allowing the feature if the user figures out how to conduct it. This vulnerability reveals the functionalities rather than information.

Most commonly this vulnerability affects a large number of companies including software development companies and websites of all sizes.

THE VULNERABILITY CAN BE COMPROMISED?


The impact of this vulnerability depends mainly on the kind of features/ information the attacker can gain the access to. It can vary from gaining access to useless data or full system takeover. The user can also gain access to the admin related rights without even getting caught/ known.

Exploitability


Taking advantage of this vulnerability and detecting this is considered very easy. This can happen when the attacker tries to gain access to a specific action on a particular system which requires proper authentication and if the request succeeds, then the page is considered vulnerable to threats. What is difficult is to figure out each page that is at risk. Sometimes it is a part of a chain attack that requires lot of creativity.

For example: If the user intercepts a request to delete its own credit card and he/she was able to change the id of that card and with this the user deleted another user’s account by mistake. This could lead to a considerable damage to the business.

How to discover the vulnerability


One way is to browse the website while it is logged it and logs all pages as visited. Next log out the website and then revisit the pages again. If you get the same result again then it proves that the vulnerability exists Another way can be to identify usernames and similar info in requests and someone can easily change it.

AFFECTED ITEMS AND SEVERITY


Severity: moderate
The business value of the revealed functions and the data is compromised. And the impact to your reputation also creates a bad impact on the market.

RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS)


 

  • There should be denial of access to various confidential data/ information/ system.

  • Every specific application should have role based access to its authorized system. It is also advisable to have a log of all failed attempt so that this may help to discover if something malicious has happened.

  • Blocking access to all file types prevent a great way to prevent an attacker for accessing any sensitive information, databases, log files etc Do not assume that the users are not aware of the hidden URL or API.

  • Verifying the users before allowing them to access resources.

  • Your application should have an easy way to analyze the authorization module.

  • If the function is involved in a proper workflow then ensure that the conditions are in proper state.

  • Also implement checks in business logic and controller.

Looking to Hire Hire MVC Development Company? Contact Now

OWASP Vulnerability: Missing Function Level Access Control An example of this vulnerability would be that an unauthorised user is able to access a URL that consists of sensitive data/ information or exposes confidential information intended for only authorized users. Another example would be to simply hide functionality from the authorized user but at the end allowing the feature if the user figures out how to conduct it. This vulnerability reveals the functionalities rather than information. Most commonly this vulnerability affects a large number of companies including software development companies and websites of all sizes. THE VULNERABILITY CAN BE COMPROMISED? The impact of this vulnerability depends mainly on the kind of features/ information the attacker can gain the access to. It can vary from gaining access to useless data or full system takeover. The user can also gain access to the admin related rights without even getting caught/ known. Exploitability Taking advantage of this vulnerability and detecting this is considered very easy. This can happen when the attacker tries to gain access to a specific action on a particular system which requires proper authentication and if the request succeeds, then the page is considered vulnerable to threats. What is difficult is to figure out each page that is at risk. Sometimes it is a part of a chain attack that requires lot of creativity. Read More: Owasp Vulnerability: Sql Injection For example: If the user intercepts a request to delete its own credit card and he/she was able to change the id of that card and with this the user deleted another user’s account by mistake. This could lead to a considerable damage to the business. How to discover the vulnerability One way is to browse the website while it is logged it and logs all pages as visited. Next log out the website and then revisit the pages again. If you get the same result again then it proves that the vulnerability exists Another way can be to identify usernames and similar info in requests and someone can easily change it. AFFECTED ITEMS AND SEVERITY Severity: moderate The business value of the revealed functions and the data is compromised. And the impact to your reputation also creates a bad impact on the market. RECOMMENDATIONS TO MITIGATE THE RISKS (AVOID/ REDUCE/ TRANSFER THE RISKS)   There should be denial of access to various confidential data/ information/ system. Every specific application should have role based access to its authorized system. It is also advisable to have a log of all failed attempt so that this may help to discover if something malicious has happened. Blocking access to all file types prevent a great way to prevent an attacker for accessing any sensitive information, databases, log files etc Do not assume that the users are not aware of the hidden URL or API. Verifying the users before allowing them to access resources. Your application should have an easy way to analyze the authorization module. If the function is involved in a proper workflow then ensure that the conditions are in proper state. Also implement checks in business logic and controller. Looking to Hire Hire MVC Development Company? Contact Now See here

Build Your Agile Team

Enter your e-mail address Please enter valid e-mail

Categories

Ensure your sustainable growth with our team

Talk to our experts
Sustainable
Sustainable
 

Blog Our insights

Logic Apps vs Power Automate: 15 Key Differences Explained
Logic Apps vs Power Automate: 15 Key Differences Explained

Automating processes is crucial for the smooth running of business, whether it is in Legal, healthcare, transport, or Fintech. Several options are accessible to do this. But which...

How to choose technology for software and IT product?
How to choose technology for software and IT product?

Despite having abundant options in the market, picking the right technology stack for a software development project is still a challenging task. As you delve deeper into the array...

Performance improvements in .NET 5
Performance improvements in .NET 5

.NET 5 already has a wealth of performance enhancements and still, there are likely chances to include a lot more improvement before the official release scheduled later this year...