Improper Access Control

Opis

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Access control involves the use of several protection mechanisms such as:

- Authentication (proving the identity of an actor)

- Authorization (ensuring that a given actor can access a resource), and

- Accountability (tracking of activities that were performed)

When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.

There are two distinct behaviors that can introduce access control weaknesses:

- Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.

- Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.

Inne nazwy

Authorization

The terms "access control" and "authorization" are often used interchangeably, although many people have distinct definitions. The CWE usage of "access control" is intended as a general term for the various mechanisms that restrict which users can access which resources, and "authorization" is more narrowly defined. It is unlikely that there will be community consensus on the use of these terms.

Skutki

• Other

  Varies by Context

Zapobieganie

• Architecture and Design, Operation

  Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

• Architecture and Design · Separation of Privilege

  Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

  Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Przykłady podatności

• CVE-2023-26463 Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)
• CVE-2022-24985 A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms
• CVE-2022-29238 Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
• CVE-2022-23607 Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect
• CVE-2021-21972 Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
• CVE-2021-37415 IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.
• CVE-2021-35033 Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port
• CVE-2020-10263 Bluetooth speaker does not require authentication for the debug functionality on the UART port, allowing root shell access
• CVE-2020-13927 Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.
• CVE-2010-4624 Bulletin board applies restrictions on number of images during post creation, but does not enforce this on editing.

Słabości podrzędne

• CWE-269 Improper Privilege Management
• CWE-282 Improper Ownership Management
• CWE-285 Improper Authorization
• CWE-286 Incorrect User Management
• CWE-287 Improper Authentication
• CWE-288 Authentication Bypass Using an Alternate Path or Channel
• CWE-346 Origin Validation Error
• CWE-639 Authorization Bypass Through User-Controlled Key
• CWE-749 Exposed Dangerous Method or Function
• CWE-862 Missing Authorization
• CWE-863 Incorrect Authorization
• CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
• CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
• CWE-1220 Insufficient Granularity of Access Control
• CWE-1224 Improper Restriction of Write-Once Bit Fields
• CWE-1231 Improper Prevention of Lock Bit Modification
• CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection
• CWE-1252 CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
• CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions
• CWE-1259 Improper Restriction of Security Token Assignment
• CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges
• CWE-1262 Improper Access Control for Register Interface
• CWE-1263 Improper Physical Access Control
• CWE-1267 Policy Uses Obsolete Encoding
• CWE-1270 Generation of Incorrect Security Tokens
• CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code
• CWE-1276 Hardware Child Block Incorrectly Connected to Parent System
• CWE-1280 Access Control Check Implemented After Asset is Accessed
• CWE-1283 Mutable Attestation or Measurement Reporting Data
• CWE-1290 Incorrect Decoding of Security Identifiers
• CWE-1292 Incorrect Conversion of Security Identifiers
• CWE-1294 Insecure Security Identifier Mechanism
• CWE-1296 Incorrect Chaining or Granularity of Debug Components
• CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
• CWE-1311 Improper Translation of Security Attributes by Fabric Bridge
• CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
• CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime
• CWE-1315 Improper Setting of Bus Controlling Capability in Fabric End-point
• CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
• CWE-1317 Improper Access Control in Fabric Bridge
• CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals
• CWE-1323 Improper Management of Sensitive Trace Data
• CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• Operation

Dotyczy

Not Language-Specific, Not Technology-Specific, ICS/OT, Web Based

Uwagi

This entry needs more work. Possible sub-categories include:

- Trusted group includes undesired entities (partially covered by CWE-286)

- Group can perform undesired actions

- ACL parse error does not fail closed

Źródła

1. Writing Secure Code — Michael Howard, David LeBlanc, Chapter 6, "Determining Appropriate Access Control" Page 171, Microsoft Press, 2002
2. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 17: Failure to Protect Stored Data." Page 253, McGraw-Hill, 2010
3. Supplemental Details - 2022 CWE Top 25 — MITRE, Details of Problematic Mappings, 2022
4. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022