CWE-862 詳細資料

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

背景詳情

引入方式

Architecture and Design
Implementation : A developer may introduce authorization weaknesses because of a lack of understanding about the underlying technologies. For example, a developer may assume that attackers cannot modify certain inputs such as headers or cookies.
Operation

適用平台

程式語言

類別： Not Language-Specific (Undetermined)
名稱： Go (Undetermined)

技術

名稱： AI/ML (Often)
名稱： Web Server (Often)
名稱： Database Server (Often)
類別： Not Technology-Specific (Undetermined)

常見後果

觀察到的案例

潛在緩解措施

Phases : Architecture and Design
Phases : Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Phases : Architecture and Design
Phases : Architecture and Design
Phases : System Configuration // Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

偵測方法

Automated Static Analysis

有效性 : Limited

Automated Dynamic Analysis

Automated dynamic analysis may find many or all possible interfaces that do not require authorization, but manual analysis is required to determine if the lack of authorization violates business logic.

Manual Analysis

有效性 : Moderate

Manual Static Analysis - Binary or Bytecode

有效性 : SOAR Partial

Dynamic Analysis with Automated Results Interpretation

有效性 : SOAR Partial

Dynamic Analysis with Manual Results Interpretation

有效性 : SOAR Partial

Manual Static Analysis - Source Code

有效性 : SOAR Partial

Automated Static Analysis - Source Code

有效性 : SOAR Partial

Architecture or Design Review

有效性 : High

漏洞對應備注

理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate
備註 : Examine children of this entry to see if there is a better fit

相關攻擊模式

備注

Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.

參考資料

REF-229

Role Based Access Control and Role Based Security
NIST.
https://csrc.nist.gov/projects/role-based-access-control

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-231

Top 25 Series - Rank 5 - Improper Access Control (Authorization)
Frank Kim.
https://www.sans.org/blog/top-25-series-rank-5-improper-access-control-authorization

REF-45

OWASP Enterprise Security API (ESAPI) Project
OWASP.
https://owasp.org/www-project-enterprise-security-api/

REF-233

Authentication using JAAS
Rahul Bhattacharjee.
https://javaranch.com/journal/2008/04/authentication-using-JAAS.html

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

REF-1566

Golang Secure Coding Practices guide
OWASP.
https://github.com/OWASP/Go-SCP

提交

修改記錄