What is an unauthorized access vulnerability?
Unauthorized access (Broken Access Control, BAC for short) is a common vulnerability in web applications. Due to its wide range and great harm, OWASP ranks the second among the top ten security risks of web applications.
This vulnerability refers to a flaw in the application's authorization check, which allows the attacker to use some methods to bypass the authorization check after obtaining a low-privilege user account, access or operate other users or higher privileges. The cause of the unauthorized vulnerability is mainly because the developer over-trusted the data requested by the client when adding, deleting, modifying, and querying the data, and omitted the judgment of the authority.
Vulnerability classification
- Horizontal unauthorized access vulnerability
Horizontal unauthorized access is a vulnerability caused by a design flaw in "data-based access control". The unauthorized data access vulnerability caused by the server side not determining the person/department of the data when receiving the requested data for operation.
There are two accounts A and B belong to the same level of authority, A can use some methods after logging in, such as passing the ID of B to check the data of B. Is the level of unauthorized access
- Vertical unauthorized access vulnerability Vertical unauthorized access
is a vulnerability caused by a design flaw in "URL-based access control", also known as a privilege escalation attack.
Many systems only control the display level when performing access control. The actual back-end does not do permission verification. If a low-privilege account logs in, you can access the URL that does not have permission by guessing the URL.
Development level understanding
The above two vulnerabilities can be divided into
-
Horizontal ultra vires == data authority
-
Vertical ultra vires == menu authority
-
The key data cannot be transmitted by the front end when designing the horizontal authority.
For example: For example, when querying orders based on order number and user id, you must add user id verification and user id can only be obtained from the backend. If your order is in order, it will be guessed. If you don’t have a user ID verification means that other people's order information will also be returned. ( Lesson learned from blood: once a colleague was fired from the company ) -
Vertical authority, most management systems are based on RBAC authority management, and authority must be allocated strictly in accordance with the authority control system.