Definition
Broken access control refers to vulnerabilities that allow unauthorized users to access restricted resources or perform actions that should be beyond their permissions. It ranks as the top issue in the OWASP Top 10 list of web application security risks as of 2021.How It Works
- 1Vertical Privilege Escalation: An attacker gains higher-level permissions than they should, such as a regular user accessing admin functions.
- 2Horizontal Privilege Escalation: An attacker accesses resources of another user with the same privilege level, like user A accessing user B's data.
- 3Path Traversal: Using '../' sequences to access files and directories outside of the intended directory.
- 4Missing Function-Level Access Control: Functions and APIs are not adequately protected, allowing unauthorized use.
- 5IDOR (Insecure Direct Object Reference): Accessing data by manipulating a reference, such as changing a URL parameter to view another user's information.
Key Characteristics
- Inadequate Authorization: Resources are insufficiently protected.
- IDOR Vulnerabilities: Direct access to objects through predictable references.
- Misconfigured Access Controls: Reliance on client-side controls rather than server-side.
Comparison
| Concept | Description |
|---|---|
| Broken Access Control | Unauthorized access to resources or actions |
| IDOR | A type of Broken Access Control involving direct object references |
| Path Traversal | Accessing unauthorized files through directory path manipulation |
Real-World Example
In the 2021 Parler data breach, sequential IDs allowed users to access others' data, exposing sensitive information. This breach highlighted the dangers of predictable references—a classic case of IDOR.Detection & Prevention
- Tools: Use Burp Suite and OWASP ZAP to identify access control weaknesses.
- Secure Coding: Implement server-side checks for authorization.
- Access Control Models: Use role-based access control (RBAC) to define permissions.
Common Misconceptions
- Client-Side Security: Believing client-side checks are sufficient for access control.
- Single Authentication Equals Authorization: Assuming that once authenticated, all actions are authorized.
- Complexity Equals Security: Thinking complex systems inherently provide better access control.