ByteOS Network

CAPEC-1:Accessing Functionality Not Properly Constrained by ACLs

Attack Pattern ID:1

Version:v3.9

Attack Pattern Name:Accessing Functionality Not Properly Constrained by ACLs

Abstraction:Standard

Status:Draft

Likelihood of Attack:High

Typical Severity:High

Details Content History Related Weaknesses Reports

▼Description

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

▼Relationships

Nature	Type	ID	Name
ChildOf	M	122	Privilege Abuse
ParentOf	D	58	Restful Privilege Elevation
ParentOf	D	679	Exploitation of Improperly Configured or Implemented Memory Protections
ParentOf	D	680	Exploitation of Improperly Controlled Registers
ParentOf	D	681	Exploitation of Improperly Controlled Hardware Security Identifiers
CanPrecede	S	17	Using Malicious Files

Nature: ChildOf

Type: Meta

ID: 122

Name: Privilege Abuse

Nature: ParentOf

Type: Detailed

ID: 58

Name: Restful Privilege Elevation

Nature: ParentOf

Type: Detailed

ID: 679

Name: Exploitation of Improperly Configured or Implemented Memory Protections

Nature: ParentOf

Type: Detailed

ID: 680

Name: Exploitation of Improperly Controlled Registers

Nature: ParentOf

Type: Detailed

ID: 681

Name: Exploitation of Improperly Controlled Hardware Security Identifiers

Nature: CanPrecede

Type: Standard

ID: 17

Name: Using Malicious Files

▼Execution Flow

Explore

Survey

The attacker surveys the target application, possibly as a valid and authenticated user

Technique
Spidering web sites for all available links
Brute force guessing of resource names
Brute force guessing of user names / credentials
Brute force guessing of function names / actions

Identify Functionality

At each step, the attacker notes the resource or functionality access mechanism invoked upon performing specific actions

Technique
Use the web inventory of all forms and inputs and apply attack data to those inputs.
Use a packet sniffer to capture and record network traffic
Execute the software in a debugger and record API calls into the operating system or important libraries. This might occur in an environment other than a production environment, in order to find weaknesses that can be exploited in a production environment.

Experiment

Iterate over access capabilities

Possibly as a valid user, the attacker then tries to access each of the noted access mechanisms directly in order to perform functions not constrained by the ACLs.

Technique
Fuzzing of API parameters (URL parameters, OS API parameters, protocol parameters)

▼Prerequisites

The application must be navigable in a manner that associates elements (subsections) of the application with ACLs.

The various resources, or individual URLs, must be somehow discoverable by the attacker

The administrator must have forgotten to associate an ACL or has associated an inappropriately permissive ACL with a particular navigable resource.

▼Skills Required

Low

In order to discover unrestricted resources, the attacker does not need special tools or skills. They only have to observe the resources or access mechanisms invoked as each action is performed and then try and access those access mechanisms directly.

▼Resources Required

None: No specialized resources are required to execute this type of attack.

▼Consequences

Scope	Likelihood	Impact	Note
ConfidentialityAccess ControlAuthorization	N/A	Gain Privileges	N/A

Scope: Confidentiality, Access Control, Authorization

Likelihood: N/A

Impact: Gain Privileges

Note: N/A

▼Mitigations

In a J2EE setting, administrators can associate a role that is impossible for the authenticator to grant users, such as "NoAccess", with all Servlets to which access is guarded by a limited number of servlets visible to, and accessible by, the user.

Having done so, any direct access to those protected Servlets will be prohibited by the web container.

In a more general setting, the administrator must mark every resource besides the ones supposed to be exposed to the user as accessible by a role impossible for the user to assume. The default security setting must be to deny access and then grant access only to those resources intended by business logic.

▼Example Instances

▼Related Weaknesses

ID	Name
CWE-1191	On-Chip Debug and Test Interface With Improper Access Control
CWE-1193	Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
CWE-1220	Insufficient Granularity of Access Control
CWE-1297	Unprotected Confidential Information on Device is Accessible by OSAT Vendors
CWE-1311	Improper Translation of Security Attributes by Fabric Bridge
CWE-1314	Missing Write Protection for Parametric Data Values
CWE-1315	Improper Setting of Bus Controlling Capability in Fabric End-point
CWE-1318	Missing Support for Security Features in On-chip Fabrics or Buses
CWE-1320	Improper Protection for Outbound Error Messages and Alert Signals
CWE-1321	Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-1327	Binding to an Unrestricted IP Address
CWE-276	Incorrect Default Permissions
CWE-285	Improper Authorization
CWE-434	Unrestricted Upload of File with Dangerous Type
CWE-693	Protection Mechanism Failure
CWE-732	Incorrect Permission Assignment for Critical Resource