Top 10-2017 A5-Broken Access Control - Revision history

T.Gigler: Editorial changes e.g. line feeds

2018-01-01T16:38:02Z

Editorial changes e.g. line feeds

T.Gigler: Prepare OWASP Top 10-2017 Release (Content)

2017-12-15T21:38:51Z

Prepare OWASP Top 10-2017 Release (Content)

Show changes

T.Gigler: Updated Navigation (incl PrevLink and NextLink)

2017-12-12T00:29:35Z

Updated Navigation (incl PrevLink and NextLink)

T.Gigler: T.Gigler moved page Top 10-2017 A4-Broken Access Control to Top 10-2017 A5-Broken Access Control: OWASP Top 10-2017 Release

2017-12-11T22:43:06Z

T.Gigler moved page Top 10-2017 A4-Broken Access Control to Top 10-2017 A5-Broken Access Control: OWASP Top 10-2017 Release

T.Gigler: T.Gigler moved page Top 10 2017-A4-Broken Access Control to Top 10-2017 A4-Broken Access Control: OWASP Top 10-2017 Release

2017-12-11T22:40:52Z

T.Gigler moved page Top 10 2017-A4-Broken Access Control to Top 10-2017 A4-Broken Access Control: OWASP Top 10-2017 Release

T.Gigler: corrected line break in Scenario#2, coulored the admin URI in red, changed the line break in Scenario#1 to the same style as Scenarion#2

2017-04-23T21:18:27Z

corrected line break in Scenario#2, coulored the admin URI in red, changed the line break in Scenario#1 to the same style as Scenarion#2

T.Gigler: underlined all links and Scenario #1/2; deleted some empty lines

2017-04-23T11:16:41Z

underlined all links and Scenario #1/2; deleted some empty lines

Neil Smithline at 23:14, 22 April 2017

2017-04-22T23:14:52Z

Neil Smithline at 22:32, 22 April 2017

2017-04-22T22:32:15Z

T.Gigler: Create an empty page for the new/reactivated Top 10 2017-A4-Broken Access Control (RC1)

2017-04-20T23:11:12Z

Create an empty page for the new/reactivated Top 10 2017-A4-Broken Access Control (RC1)

New page

{{Top_10_2013:TopTemplate
|usenext=2013NextLink
|next=A5-{{Top_10_2010:ByTheNumbers
|5
|year=2017
|language=en}}
|useprev=2013PrevLink
|prev=A3-{{Top_10_2010:ByTheNumbers
|3
|year=2017
|language=en}}
|year=2017
|language=en
}}

{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}}
{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=3|detectability=1|impact=2|year=2017|language=en}}
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
{{Top_10_2010:SummaryTableEndTemplate|year=2017}}

{{Top_10:SubsectionTableBeginTemplate|year=2017|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=4|year=2017|language=en}}

{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=4|year=2017|language=en}}

{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=4|year=2017|language=en}}



{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=4|year=2017|language=en}}
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017}}
*
{{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}}
*

{{Top_10_2013:BottomAdvancedTemplate
|type={{Top_10_2010:StyleTemplate}}
|usenext=2013NextLink
|next=A5-{{Top_10_2010:ByTheNumbers
|5
|year=2017
|language=en}}
|useprev=2013PrevLink
|prev=A3-{{Top_10_2010:ByTheNumbers
|3
|year=2017
|language=en}}
|year=2017
|language=en
}}

[[Category:OWASP Top Ten Project]]

@@ Line 24: / Line 24: @@
      <td colspan=2  {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Security Weakness: --->
-  Access control weaknesses are common due to the lack of automated detection, and lack of effective functional testing by application developers. Access control detection is not typically amenable to automated static or dynamic testing. Manual testing is the best way to detect missing or ineffective access control, including HTTP method (GET vs PUT, etc), controller, direct object references, etc. </td>
+  Access control weaknesses are common due to the lack of automated detection, and lack of effective functional testing by application developers.<br/>Access control detection is not typically amenable to automated static or dynamic testing. Manual testing is the best way to detect missing or ineffective access control, including HTTP method (GET vs PUT, etc), controller, direct object references, etc. </td>
      <td colspan=2  {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Impacts: --->
-  The technical impact is attackers acting as users or administrators, or users using privileged functions, or creating, accessing, updating or deleting every record. The business impact depends on the protection needs of the application and data. </td>
+  The technical impact is attackers acting as users or administrators, or users using privileged functions, or creating, accessing, updating or deleting every record.<br/>The business impact depends on the protection needs of the application and data. </td>
 {{Top_10_2010:SummaryTableEndTemplate|year=2017}}
@@ Line 50: / Line 50: @@
 * Rate limit API and controller access to minimize the harm from automated attack tooling.
 * JWT tokens should be invalidated on the server after logout.
-* Developers and QA staff should include functional access control unit and integration tests.
+Developers and QA staff should include functional access control unit and integration tests.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=exampleAttackScenarios|position=left|year=2017|language=en}}

@@ Line 62: / Line 62: @@
 <u>'''Scenario #1:'''</u> The application uses unverified data in a SQL call that is accessing account information:
-{{Top_10_2010:ExampleBeginTemplate|year=2017}}<span style="color:red;">pstmt.setString( 1, request.getParameter("acct"));</span>
+{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b><span style="color:red;"><nowiki>
-ResultSet results = pstmt.executeQuery( );
+pstmt.setString(1, request.getParameter("acct"));</nowiki></span><br/><nowiki>
 {{Top_10_2010:ExampleEndTemplate}}
 An attacker simply modifies the ‘acct’ parameter in the browser to send whatever account number they want. If not properly verified, the attacker can access any user’s account.
-{{Top_10_2010:ExampleBeginTemplate|year=2017}}<nowiki>
+{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b><nowiki>
-http://example.com/app/accountInfo?acct=</nowiki><span style="color:red;">notmyacct</span>
+http://example.com/app/accountInfo?acct=</nowiki><span style="color:red;">notmyacct</span></b>
 {{Top_10_2010:ExampleEndTemplate}}<br>
 <u>'''Scenario #2:'''</u> An attacker simply force browses to target URLs. Admin rights are also required for access to the admin page.
-{{Top_10_2010:ExampleBeginTemplate|year=2017}}<nowiki>http://example.com/app/getappInfo
+{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b><nowiki>
-http://example.com/app/admin_getInfo</nowiki>{{Top_10_2010:ExampleEndTemplate}}
+http://example.com/app/getappInfo</nowiki><br/><nowiki>
 If an unauthenticated user can access either page, it’s a flaw. If a non-admin can access the admin page, this is also a flaw.

@@ Line 56: / Line 56: @@
 Preventing access control flaws requires selecting an approach for protecting each function and each type of data (e.g., object number, filename).
 # '''Check access'''. Each use of a direct reference from an untrusted source must include an access control check to ensure the user is authorized for the requested resource.
-# '''Use per user or session indirect object references'''. This coding pattern prevents attackers from directly targeting unauthorized resources. For example, instead of using the resource’s database key, a drop down list of six resources authorized for the current user could use the numbers 1 to 6 to indicate which value the user selected. OWASP’s [[ESAPI]] includes both sequential and random access reference maps that developers can use to eliminate direct object references.
+# '''Use per user or session indirect object references'''. This coding pattern prevents attackers from directly targeting unauthorized resources. For example, instead of using the resource’s database key, a drop down list of six resources authorized for the current user could use the numbers 1 to 6 to indicate which value the user selected. OWASP’s <u>[[ESAPI]]</u> includes both sequential and random access reference maps that developers can use to eliminate direct object references.
 # '''Automated verification'''. Leverage automation to verify proper authorization deployment. This is often custom.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=4|year=2017|language=en}}
-'''Scenario #1:''' The application uses unverified data in a SQL call that is accessing account information:
+<u>'''Scenario #1:'''</u> The application uses unverified data in a SQL call that is accessing account information:
 {{Top_10_2010:ExampleBeginTemplate|year=2017}}<span style="color:red;">pstmt.setString( 1, request.getParameter("acct"));</span>
@@ Line 68: / Line 68: @@
 {{Top_10_2010:ExampleBeginTemplate|year=2017}}<nowiki>
 http://example.com/app/accountInfo?acct=</nowiki><span style="color:red;">notmyacct</span>
-{{Top_10_2010:ExampleEndTemplate}}
+{{Top_10_2010:ExampleEndTemplate}}<br>
 '''Scenario #2:''' An attacker simply force browses to target URLs. Admin rights are also required for access to the admin page.
 {{Top_10_2010:ExampleBeginTemplate|year=2017}}<nowiki>http://example.com/app/getappInfo
 http://example.com/app/admin_getInfo</nowiki>{{Top_10_2010:ExampleEndTemplate}}
 If an unauthenticated user can access either page, it’s a flaw. If a non-admin can access the admin page, this is also a flaw.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=4|year=2017|language=en}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017}}
-* [[Top_10_2007-Insecure_Direct_Object_Reference|OWASP Top 10-2007 on Insecure Direct Object References]]
+* <u>[[Top_10_2007-Insecure_Direct_Object_Reference|OWASP Top 10-2007 on Insecure Direct Object References]]</u>
-* [[Top_10_2007-Failure_to_Restrict_URL_Access|OWASP Top 10-2007 on Function Level Access Control]]
+* <u>[[Top_10_2007-Failure_to_Restrict_URL_Access|OWASP Top 10-2007 on Function Level Access Control]]</u>
-* [https://static.javadoc.io/org.owasp.esapi/esapi/2.1.0.1/org/owasp/esapi/AccessReferenceMap.html ESAPI Access Reference Map API]
+* <u>[https://static.javadoc.io/org.owasp.esapi/esapi/2.1.0.1/org/owasp/esapi/AccessReferenceMap.html ESAPI Access Reference Map API]</u>
-* [https://static.javadoc.io/org.owasp.esapi/esapi/2.1.0.1/org/owasp/esapi/AccessController.html ESAPI Access Control API] (See isAuthorizedForData(), isAuthorizedForFile(), isAuthorizedForFunction() )
+* <u>[https://static.javadoc.io/org.owasp.esapi/esapi/2.1.0.1/org/owasp/esapi/AccessController.html ESAPI Access Control API]</u> (See isAuthorizedForData(), isAuthorizedForFile(), isAuthorizedForFunction() )
-For additional access control requirements, see the [[ASVS|ASVS requirements area for Access Control (V4)]].
+For additional access control requirements, see the <u>[[ASVS|ASVS requirements area for Access Control (V4)]]</u>.
 {{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}}
-* [http://cwe.mitre.org/data/definitions/285.html CWE Entry 285 on Improper Access Control (Authorization)]
+* <u>[http://cwe.mitre.org/data/definitions/285.html CWE Entry 285 on Improper Access Control (Authorization)]</u>
-* [http://cwe.mitre.org/data/definitions/639.html CWE Entry 639 on Insecure Direct Object References]
+* <u>[http://cwe.mitre.org/data/definitions/639.html CWE Entry 639 on Insecure Direct Object References]</u>
-* [http://cwe.mitre.org/data/definitions/22.html CWE Entry 22 on Path Traversal] (an example of a Direct Object Reference weakness)
+* <u>[http://cwe.mitre.org/data/definitions/22.html CWE Entry 22 on Path Traversal]</u> (an example of a Direct Object Reference weakness)
 {{Top_10_2013:BottomAdvancedTemplate

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
-     |usenext=2013NextLink
+     |usenext=2017NextLink
-     |next=A5-{{Top_10_2010:ByTheNumbers
+     |next=A6-{{Top_10_2010:ByTheNumbers
-               |5
+               |6
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
-     |prev=A3-{{Top_10_2010:ByTheNumbers
+     |prev=A4-{{Top_10_2010:ByTheNumbers
-               |3
+               |4
                |year=2017
                |language=en}}
@@ Line 93: / Line 93: @@
 {{Top_10_2013:BottomAdvancedTemplate
      |type={{Top_10_2010:StyleTemplate}}
-     |usenext=2013NextLink
+     |usenext=2017NextLink
-     |next=A5-{{Top_10_2010:ByTheNumbers
+     |next=A6-{{Top_10_2010:ByTheNumbers
-               |5
+               |6
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
-     |prev=A3-{{Top_10_2010:ByTheNumbers
+     |prev=A4-{{Top_10_2010:ByTheNumbers
-               |3
+               |4
                |year=2017
                |language=en}}

← Older revision	Revision as of 22:43, 11 December 2017
(No difference)

← Older revision	Revision as of 22:40, 11 December 2017
(No difference)

@@ Line 1: / Line 1: @@
-{{Top_10_2013:TopTemplate
+'''Bold text''''''Bold text'''{{Top_10_2013:TopTemplate
      |usenext=2013NextLink
      |next=A5-{{Top_10_2010:ByTheNumbers
@@ Line 15: / Line 15: @@
 {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}}
-  {{Top_10:SummaryTableTemplate|exploitability=2|prevalence=3|detectability=1|impact=2|year=2017|language=en}}
+  {{Top_10:SummaryTableTemplate|exploitability=1|prevalence=1|detectability=1|impact=2|year=2017|language=en}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Threat Agents: --->
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Attack Vectors --->
 </td>
       <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Security Weakness --->
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Technical Impacts --->
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Business Impacts  --->
 </td>
@@ Line 40: / Line 47: @@
 {{Top_10:SubsectionTableBeginTemplate|year=2017|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=4|year=2017|language=en}}
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=4|year=2017|language=en}}
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=4|year=2017|language=en}}
+{{Top_10_2010:ExampleBeginTemplate|year=2017}}<span style="color:red;">pstmt.setString( 1, request.getParameter("acct"));</span>
@@ Line 53: / Line 80: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=4|year=2017|language=en}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017}}
+* [[Top_10_2007-Insecure_Direct_Object_Reference|OWASP Top 10-2007 on Insecure Direct Object References]]
 {{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}}
+* [http://cwe.mitre.org/data/definitions/285.html CWE Entry 285 on Improper Access Control (Authorization)]
 {{Top_10_2013:BottomAdvancedTemplate