{"id":17260,"date":"2021-05-25T15:45:00","date_gmt":"2021-05-25T13:45:00","guid":{"rendered":"https:\/\/usd.formwandler.rocks\/?p=17260"},"modified":"2021-08-04T15:52:06","modified_gmt":"2021-08-04T13:52:06","slug":"news-usd-herolab-top-5-vulnerabilities-2020-broken-access-control","status":"publish","type":"post","link":"https:\/\/www.usd.de\/en\/news-usd-herolab-top-5-vulnerabilities-2020-broken-access-control\/","title":{"rendered":"usd HeroLab Top 5 Vulnerabilities 2020: Broken Access Control"},"content":{"rendered":"\n

During penetration tests<\/a> our security analysts<\/a> repeatedly uncover gateways in IT systems and applications that pose significant risks to corporate security. They increasingly identify the same vulnerabilities in different IT assets, some of which have been known for years. In our mini-series, we present our top 5 most notable vulnerabilities from 2020. Part 2: Broken Access Control<\/p>\n\n\n\n

<\/div>\n\n\n\n

Vulnerability Background<\/h3>\n\n\n\n

Broken access control refers to vulnerabilities in which endpoints or functionalities in an application are not sufficiently protected by authentication or authorization mechanisms. Attackers can access these endpoints or use corresponding functionalities without having sufficient permissions to do so. One of the most common reasons for the vulnerability to occur is that only client-side validation of requests is used, while no further checking is performed on the server side.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Exemplary hacker attack and its consequences<\/h3>\n\n\n\n

Our example is an application that validates user requests on the client side only. The following screenshot shows a corresponding error message when a low privileged user tries to access administrative application content.<\/p>\n\n\n\n

\"\"
Figure 1 Access to the administration in the form of an HTTP GET request is prevented by the application<\/figcaption><\/figure>\n\n\n\n
<\/div>\n\n\n\n
\"\"
Figure 2 HTTP POST request to set a password with a non-privileged user is still executed successfully<\/figcaption><\/figure>\n\n\n\n

Although a low-privileged user cannot see the administrative section of the application, he can send the request shown above to reset the password of any user. Information about the corresponding endpoint could be obtained by an attacker from internal sources, the application\u2018s JavaScript code, or simply by guessing.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Recommended measures<\/h3>\n\n\n\n

Client-side access control should never be used as the only safeguard against unauthorized access. As demonstrated above, a lack of representation within the application does not prevent an attacker from using the endpoint anyway. Only validation on the server side can prevent unauthorized use of an endpoint. This applies not only to web applications but also to desktop applications (thick clients).<\/p>\n\n\n\n

Please note that this is a very general recommendation for security measures. We are happy to support you with individual solutions. Feel free to contact us<\/a>.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
\n
\n
\"\"
<\/figcaption><\/figure><\/div>\n<\/div>\n\n\n\n
\n

Read more about our top 5 most notable vulnerabilities and other exciting topics in our 2020 Annual Report<\/a>.<\/p>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

During penetration tests our security analysts repeatedly uncover gateways in IT systems and applications that pose significant risks to corporate security. They increasingly identify the same vulnerabilities in different IT assets, some of which have been known for years. In our mini-series, we present our top 5 most notable vulnerabilities from 2020. Part 2: Broken […]<\/p>\n","protected":false},"author":96,"featured_media":15972,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"categories":[373,374],"tags":[1448,1452,377,378,379],"class_list":["post-17260","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-en","category-pentests-security-analyses-en","tag-application-security","tag-broken-access-control-2","tag-penetrationstest-en","tag-pentest-en","tag-sicherheit-von-anwendungen-en"],"_links":{"self":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/posts\/17260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/comments?post=17260"}],"version-history":[{"count":0,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/posts\/17260\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/media\/15972"}],"wp:attachment":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/media?parent=17260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/categories?post=17260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/tags?post=17260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}