Missing Function Level Access Control

What is Function Level Access Control?

Could result from insufficient protection of sensitive request handlers within an application:

• Can a user directly browse to a resource?
• Does the UI expose an unauthorized resource?

It can be anything from seemingly useless information to a full system takeover.

Function Level Access Control examples

Example #1: Force-Browsing the URL

• Go to a site and notice the URL: http://randomsite.com
• Click a link or application and see this URL: http://randomsite.com/app/getappinfo
• Now, you simply add a parameter to see if the page exists. If so, you now have administrator access to the application. http://randomsite.com/app/admin_getappinfo

Example #2: Horizontal Access Attack

• User goes to a site, logs in to confirm authorization to site resources: http://randomsite.com/app/userId=21775
• User changes the userId to that of another user: http://randomsite.com/app/userId=31356
• If proper authorization procedures are not in place, the user now has the ability to login as other users simply by changing the userID