Direct Request ('Forced Browsing')

Opis

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Inne nazwy

forced browsing

The "forced browsing" term could be misinterpreted to include weaknesses such as CSRF or XSS, so its use is discouraged.

Skutki

• Confidentiality, Integrity, Availability, Access Control

  Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity

Zapobieganie

• Architecture and Design, Operation

  Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

• Architecture and Design

  Consider using MVC based frameworks such as Struts.

Przykłady podatności

• CVE-2022-29238 Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
• CVE-2004-2144 Bypass authentication via direct request.
• CVE-2005-1892 Infinite loop or infoleak triggered by direct requests.
• CVE-2004-2257 Bypass auth/auth via direct request.
• CVE-2005-1688 Direct request leads to infoleak by error.
• CVE-2005-1697 Direct request leads to infoleak by error.
• CVE-2005-1698 Direct request leads to infoleak by error.
• CVE-2005-1685 Authentication bypass via direct request.
• CVE-2005-1827 Authentication bypass via direct request.
• CVE-2005-1654 Authorization bypass using direct request.
• CVE-2005-1668 Access privileged functionality using direct request.
• CVE-2002-1798 Upload arbitrary files via direct request.

Słabość nadrzędna

• CWE-862 Missing Authorization
• CWE-288 Authentication Bypass Using an Alternate Path or Channel
• CWE-424 Improper Protection of Alternate Path

Może prowadzić do

• CWE-471 Modification of Assumed-Immutable Data (MAID)
• CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Kiedy powstaje

• Implementation — Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.
• Operation

Dotyczy

Not Language-Specific, Web Based, Web Server

Uwagi

Overlaps Modification of Assumed-Immutable Data (MAID), authorization errors, container errors; often primary to other weaknesses such as XSS and SQL injection.

"Forced browsing" is a step-based manipulation involving the omission of one or more steps, whose order is assumed to be immutable. The application does not verify that the first step was performed successfully before the second step. The consequence is typically "authentication bypass" or "path disclosure," although it can be primary to all kinds of weaknesses, especially in languages such as PHP, which allow external modification of assumed-immutable variables.