Broken access control (ultra vires)
Broken access control is the control not subjected to the proper user access authentication. Functions or data (direct object references or restricted URL) attacker could exploit these flaws unauthorized access. For example: access other users 'accounts, view sensitive files, modify other users' data, change the access permissions.
- Manifestations:
Level security permissions attacks
vertical privilege escalation attack
Broken access control prevention
1 Use an indirect object reference - This prevents an attacker direct access to the object of its unauthorized wells, allowing the attacker by means of a mapping or other methods can not directly access the
2-inspection visit - every one from do not trust the source of the direct object references must include access control checks, so make sure the user has access to that object.
3, if the URL is not public, it must be able to limit his access to authorized users
4, a complete ban on access to unauthorized page type (such as configuration files, log files, source files, etc.)