Top 10 2010-A4-Insecure Direct Object References - Revision history

Neil Smithline at 02:17, 2 May 2010

2010-05-02T02:17:16Z

Neil Smithline at 04:52, 1 May 2010

2010-05-01T04:52:35Z

Neil Smithline at 00:52, 29 April 2010

2010-04-29T00:52:16Z

Neil Smithline at 22:00, 23 April 2010

2010-04-23T22:00:47Z

Wichers at 17:38, 22 April 2010

2010-04-22T17:38:26Z

Wichers at 16:25, 22 April 2010

2010-04-22T16:25:55Z

Wichers at 15:53, 22 April 2010

2010-04-22T15:53:42Z

Wichers at 15:52, 22 April 2010

2010-04-22T15:52:49Z

Wichers at 15:47, 22 April 2010

2010-04-22T15:47:18Z

Neil Smithline at 19:37, 21 April 2010

2010-04-21T19:37:10Z

@@ Line 25: / Line 25: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=3|risk=4}}
 The application uses unverified data in a SQL call that is accessing account information:
-:<b>String query = "SELECT * FROM accts WHERE account = ?";
+{{Top_10_2010:ExampleBeginTemplate}}String query = "SELECT * FROM accts WHERE account = ?";<br/>    PreparedStatement pstmt = connection.prepareStatement(query , ... );<br/><span style="color:red">pstmt.setString( 1, request.getParameter("acct"));</span><br/>ResultSet results = pstmt.executeQuery();{{Top_10_2010:ExampleEndTemplate}}
 The attacker simply modifies the ‘acct’ parameter in their browser to send whatever account number they want. If not verified, the attacker can access any user’s account, instead of only the intended customer’s account.
-:<b><nowiki>http://example.com/app/accountInfo?acct=</nowiki><span style="color:red">notmyacct</span></b>
+{{Top_10_2010:ExampleBeginTemplate}}<nowiki>http://example.com/app/accountInfo?acct=notmyacct</nowiki>{{Top_10_2010:ExampleEndTemplate}}
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=4|risk=4}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}

@@ Line 1: / Line 1: @@
 {{Top_10_2010:TopTemplate|useprev=2010PrevLink|usenext=2010NextLink|prev=A3-Broken Authentication and Session Management|next=A5-Cross-Site Request Forgery (CSRF)}}
-Also consider the business impact of public exposure of the vulnerability.
+{{Top_10_2010:SummaryTableHeaderBeginTemplate}}
-|}
+{{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}}
-</center>
+{{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=1|risk=4}}
 The best way to find out if an application is vulnerable to insecure direct object references is to verify that all object references have appropriate defenses. To achieve this, consider:

@@ Line 25: / Line 25: @@
 |}
 </center>
-{{Top_10_2010:SubsectionVulnerableTemplate|Insecure Direct Object References|
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=1|risk=4}}
 The best way to find out if an application is vulnerable to insecure direct object references is to verify that all object references have appropriate defenses. To achieve this, consider:
 #For '''direct''' references to '''restricted''' resources, the application needs to verify the user is authorized to access the exact resource they have requested.
 #If the reference is an '''indirect''' reference, the mapping to the direct reference must be limited to values authorized for the current user.
 Code review of the application can quickly verify whether either approach is implemented safely. Testing is also effective for identifying direct object references and whether they are safe. Automated tools typically do not look for such flaws because they cannot recognize what requires protection or what is safe or unsafe.
-}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=2|risk=4}}
 Preventing insecure direct object references requires selecting an approach for protecting each user accessible object (e.g., object number, filename):
 # Use per user or session indirect object references. This prevents attackers from directly targeting unauthorized resources. For example, instead of using the resource’s database key, a drop down list of six resources authorized for the current user could use the numbers 1 to 6 to indicate which value the user selected. The application has to map the per-user indirect reference back to the actual database key on the server. OWASP’s [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Authenticator.html ESAPI] includes both sequential and random access reference maps that developers can use to eliminate direct object references.
 # Check access. Each use of a direct object reference from an untrusted source must include an access control check to ensure the user is authorized for the requested object.
-}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=3|risk=4}}
 The application uses unverified data in a SQL call that is accessing account information:
 :<b>String query = "SELECT * FROM accts WHERE account = ?";
@@ Line 45: / Line 43: @@
 :<b><nowiki>http://example.com/app/accountInfo?acct=</nowiki><span style="color:red">notmyacct</span></b>
-{{Top_10_2010:SubsectionReferencesTemplate|Injection}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=4|risk=4}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 * [[Top_10_2007-Insecure_Direct_Object_Reference | OWASP Top 10-2007 on Insecure Dir Object References]]
@@ Line 56: / Line 54: @@
 * [http://cwe.mitre.org/data/definitions/639.html CWE Entry 639 on Insecure Direct Object References]
 * [http://cwe.mitre.org/data/definitions/22.html CWE Entry 22 on Path Traversal] (which is an example of a Direct Object Reference attack)
-{{Top_10_2010:BottomTemplate|useprev=2010PrevLink|usenext=2010NextLink|prev=A3-Broken Authentication and Session Management|next=A5-Cross-Site Request Forgery (CSRF)}}
+{{Top_10_2010:BottomAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|useprev=2010PrevLink|usenext=2010NextLink|prev=A3-Broken Authentication and Session Management|next=A5-Cross-Site Request Forgery (CSRF)}}
 [[Category:OWASP Top Ten Project]]

@@ Line 3: / Line 3: @@
 {| style="align:center; text-align:center; border:2px solid #4F81BD; background-color:#F2F2F2; padding=2;"
 |- style="background-color: #4F81Bd; color: #FFFFFF;"
-! Threat Agents !! Attack Vectors
+! width="16.5%" | Threat Agents
-! colspan="2" | Security Weakness
+! width="16.5%" | Attack Vectors
-! Technical Impacts
+! width="33%" colspan="2" | Security Weakness
-! Business Impacts
+! width="16.5%" | Technical Impacts
 |-
 | style="background-color: #D9D9D9; color: #000000;" | ______
@@ Line 14: / Line 15: @@
 | style="background-color: #FFB200; color: #000000;" | '''Impact<br>MODERATE
 | style="background-color: #D9D9D9; color: #000000;" | ______
-|-
+|-valign="top"
 | style="text-align: left; border: 2px solid #FFFFFF;" | Consider the types of users of your system. Do any users have only partial access to certain types of system data?
 | style="text-align: left; border: 2px solid #FFFFFF;" | Attacker, who is an authorized system user, simply changes a parameter value that directly refers to a system object to another object the user isn’t authorized for. Is access granted?

← Older revision		Revision as of 17:38, 22 April 2010
Line 56:		Line 56:
	* [http://cwe.mitre.org/data/definitions/22.html CWE Entry 22 on Path Traversal] (which is an example of a Direct Object Reference attack)		* [http://cwe.mitre.org/data/definitions/22.html CWE Entry 22 on Path Traversal] (which is an example of a Direct Object Reference attack)
	{{Top_10_2010:BottomTemplate\|useprev=2010PrevLink\|usenext=2010NextLink\|prev=A3-Broken Authentication and Session Management\|next=A5-Cross-Site Request Forgery (CSRF)}}		{{Top_10_2010:BottomTemplate\|useprev=2010PrevLink\|usenext=2010NextLink\|prev=A3-Broken Authentication and Session Management\|next=A5-Cross-Site Request Forgery (CSRF)}}
		+
		+	[[Category:OWASP Top Ten Project]]

@@ Line 50: / Line 50: @@
 * [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/AccessController.html ESAPI Access Control API] (See isAuthorizedForData(), isAuthorizedForFile(), isAuthorizedForFunction() )
-For additional access control requirements, see the [[ASVS#tab=Downloads | ASVS requirements area for Access Control (V4)]]
+For additional access control requirements, see the [http://www.owasp.org/index.php/ASVS#tab=Downloads ASVS requirements area for Access Control (V4)]
 {{Top_10_2010:SubSubsectionExternalReferencesTemplate}}