Welcome to the third and last part of broken access control session.
In this part, we will discuss broken Access Control mitigation.
We will start discussing what makes an application vulnerable. And then,
we will hunt a wasp Juice Shop, vulnerable source code.
Before closing, this session. We will discuss
how to avoid such vulnerabilities.
In our Target application, managing customer feedback.
Our actions reserved to administrators. We
saw that directly requesting specific routes or
manipulating the HTTP verb, we could execute those
same actions, some applications trust
that because addresses to access specific pages
are not known. They are reserved to those. Who
knows the URL security through obscurity
is a misconception and there are plenty of word
lists and automatic tools to help uncovering such hidden.
Dresses.
Misconfigured cross-origin resource sharing policies.
May allow access to resources from unauthorized origins
in such situations attackers, who
are able to drive victims to visit. The website under their
control, will be able to interact with the application behind
the scene and on victims behalf.
If untrusted data just as values from cookies,
or even Fields Drive Access Control decisions. Then
the application is likely vulnerable.
Let's review Juice Shop vulnerable source code.
From projects page, we will jump to the GitHub repo.
First, we want to see how the feedbacks API endpoint is set up
in the server.js file.
Regardless the HTTP verb when a
request is made to the feedbacks API endpoint. With an identifier, the
he's authorized method of the insecurity library is
called. Let's check its implementation.
Is authorized is a simple function that calls
the express JWT function.
The express JWT function is provided by the npm
express JWT package.
According to the documentation, this package does nothing
else than validate. The Json, web token. No
wonder ship, validation is performed upon the requested resources.
And this is why we were able to
access in delete other users feedback.
Let's see if there's something else in the server.js file.
Requests to create retrieve and delete feedback,
records are passed directly to the feedback model. Let's
see its implementation.
implementation has no additional Access Control validations
Let's discuss how to prevent this type of flaws.
You should always follow the principle of least privilege in
particular, abstraction layer of a Computing environment
every module, such as the user must
be able to access, only the information and resources that
are necessary for its legitimate purpose, deny
access by default except for
public resources.
building and using a centralized Access Control mechanism
will make your life easier, not only managing
privileges, but also discovering and fixing bugs,
log Access Control failures with
enough details and alert, the administrators so
that they can act in a timely fashion when required
Implement rate-limiting to minimize the amount of data exposed by
a single endpoint in case of a broken access control issue.
In our next session, we will discuss security misconfigurations
until then take your
time to carefully. Read the broken Access Control section of our
top 10.