Store

Broken Access Control

Broken access control is nothing but a loophole in the access control system that allows attackers to bypass authorization and gain access of a resource as privileged users.

For example, an application could allow users to change which account they are logged into by modifying a part of the URL in order to access a resource having more restrictive privileges.

This vulnerability is also enable users to perform certain tasks as though they were privileged users such as administrators.

Category:

Description

Remediation Techniques:

  • Deny all other resources by default except public resources and maintain logs for access control failures and alert admins.
  • Implement access control checks throughout the application, including minimizing cross-origin resource sharing (CORS) usage.
  • Access controls can be secured by verifying that the web application uses authorization tokens and sets tight controls on them on each accessible resources by privileged users.
  • Many web platforms issue authorization tokens when users log in. Every privileged request that a user makes to access any particular type of resource, will require that authorization token be present. Also in backend method level access controls can be implemented programmatic way in order to make sure that a user with a particular privileges can access a particular resource after the user logs in.

Related products