Chi tiết CWE-863

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Chi tiết nền tảng

Các cách xuất hiện

Architecture and Design : Authorization weaknesses may arise when a single-user application is ported to a multi-user environment.
Implementation
Operation

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)
Tên: Go (Undetermined)

Công nghệ

Tên: Web Server (Often)
Tên: Database Server (Often)
Lớp: Not Technology-Specific (Undetermined)

Hậu quả phổ biến

Ví dụ đã quan sát

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Phases : Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Phases : Architecture and Design
Phases : Architecture and Design
Phases : System Configuration // Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Phương pháp phát hiện

Automated Static Analysis

Hiệu quả : Limited

Automated Dynamic Analysis

Automated dynamic analysis may not be able to find interfaces that are protected by authorization checks, even if those checks contain weaknesses.

Manual Analysis

Hiệu quả : Moderate

Manual Static Analysis - Binary or Bytecode

Hiệu quả : SOAR Partial

Dynamic Analysis with Automated Results Interpretation

Hiệu quả : SOAR Partial

Dynamic Analysis with Manual Results Interpretation

Hiệu quả : SOAR Partial

Manual Static Analysis - Source Code

Hiệu quả : SOAR Partial

Automated Static Analysis - Source Code

Hiệu quả : SOAR Partial

Architecture or Design Review

Hiệu quả : High

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is a Class and might have Base-level children that would be more appropriate
Bình luận : Examine children of this entry to see if there is a better fit

Ghi chú

Tài liệu tham khảo

REF-229

Role Based Access Control and Role Based Security
NIST.
https://csrc.nist.gov/projects/role-based-access-control

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-231

Top 25 Series - Rank 5 - Improper Access Control (Authorization)
Frank Kim.
https://www.sans.org/blog/top-25-series-rank-5-improper-access-control-authorization

REF-233

Authentication using JAAS
Rahul Bhattacharjee.
https://javaranch.com/journal/2008/04/authentication-using-JAAS.html

REF-45

OWASP Enterprise Security API (ESAPI) Project
OWASP.
https://owasp.org/www-project-enterprise-security-api/

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

REF-1566

Golang Secure Coding Practices guide
OWASP.
https://github.com/OWASP/Go-SCP

Gửi

Sửa đổi