Improper Access Control [CWE-284]

Improper Access Control weakness describes a failure in the AAA security model.

Created: September 11, 2012
Latest Update: December 15, 2020

Table of Content

1. Description
2. Potential impact
3. Attack patterns
4. Affected software
5. Severity and CVSS Scoring
6. Mitigations
7. References
8. Latest Related Security Advisories

Want to have an in-depth understanding of all modern aspects of
Improper Access Control [CWE-284]? Read carefully this article and bookmark it to get back later, we regularly update this page.

1. Description

Access control is a security process that controls usage of specific resources within a predefined criteria and is a part of the AAA (Authentication, Authorization, Accounting) security model. All modern systems use certain access control models to manage their security. Access control models can be grouped in three main classes: Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role Based Access Control (RBAC).

The Improper Access Control weakness describes a case where software fails to restrict access to an object properly. A malicious user can compromise security of the software and perform certain unauthorized actions by gaining elevated privileges, reading otherwise restricted information, executing commands, bypassing implemented security mechanisms, etc.

Two major behaviors can potentially introduce the access control weaknesses:

• Specification: Some permissions, privileges or ownerships, which are initially intended for certain users or processes, can indeed be applied to other users or processes (e.g. placing a file with secured key into a word-readable directory, or assigning capabilities of a privileged account to a guest user).
• Enforcement: the security mechanism contains errors that prevent proper enforcement of the specified access control requirements (e.g. allowing the user to specify his own access controls or allowing incorrect access control lists to produce insecure settings). This problem occurs within the application that does not correctly enforce or inherits the intended security policy.

The following PHP code can be used as an example of the improper access control weakness:

In the above code, the ACCESS_DENIED constant is erroneously declared as false. An attacker might be able to send a HTTP POST request to the script, bypass the authorization checks intended for the HTTP GET method, and gain access to output of the ShowPrivilegedContent() function.

2. Potential impact

This weakness allows an attacker to bypass intended security restrictions and perform a variety of actions depending on the source of error and functionality of the application. An attacker might be able to perform certain actions by gaining elevated privileges, reading otherwise restricted information, executing commands, bypassing implemented security mechanisms, etc.

3. Attack patterns

There is only one CAPEC pattern that is related to this weakness:

• CAPEC-19: Embedding Scripts within Scripts

This weakness is not described as an attack technique in WASC Threat Classification database.

4. Affected software

Any software intended to handle access controls is potentially vulnerable to this weakness.

5. Severity and CVSS Scoring

This vulnerability could be scored differently depending on application's design, its functionality and potential security impact. In case an attacker gets full control over the application or can read, modify and delete data, it should be scored as:
9.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H] – Critical severity.

6. Mitigations

Improper access control weaknesses usually result in logic errors. Developers must carefully manage settings and handling of privileges as well as pay attention to security zones within the application. They should also integrate mechanisms that control privilege separation functionality and think about creating architecture that relies on the least privilege principle.

7. References

1. CWE-284: Improper Access Control [cwe.mitre.org]
2. Insufficient Authorization [projects.webappsec.org]
3. Mandatory access control [wikipedia.org]
4. Mandatory Access Control [lindqvist.awardspace.info]
5. Access Control: Policies, Models, and Mechanisms [spdp.dti.unimi.it]
6. Access Control Model (Windows) [msdn.microsoft.com]

8. Improper Access Control Vulnerabilities, Exploits and Examples

• HTB23254: Multiple Vulnerabilities in TheCartPress WordPress plugin
• HTB23243: Multiple vulnerabilities in MantisBT
• HTB23238: Multiple vulnerabilities in EspoCRM
• HTB23219: Improper Access Control in ArticleFR
• HTB23202: Multiple Vulnerabilities in OpenDocMan

Copyright Disclaimer: Any above-mentioned content can be copied and used for non-commercial purposes only if proper credit to ImmuniWeb is given.