Authorization (AZ5)

The key concept for this card is applying authorization controls to all resource types. See Authorization 6 (AZ6) for data controls, and Authorization 7 (AZ7) for function/object/property controls.

Scenario: Chad’s Unauthorized Access Due to Insufficient Authorization

Imagine a scenario where Chad gains access to various resources that he should not be able to access. This occurs due to:

1. Missing Authorization Checks: Certain resources lack proper authorization controls.
2. Excessive Privileges: The system grants more privileges than necessary, failing to adhere to the principle of least privilege.

Example

Chad discovers that a corporate application does not enforce strict authorization checks on certain resources, such as temporary files, system properties, and logs. He exploits this oversight to access sensitive documents and configuration data meant for higher-privileged users. Additionally, due to the system granting excessive privileges to regular users, Chad can access and interact with services and processes usually reserved for administrators.

Threat Modeling

STRIDE

This scenario maps primarily to STRIDE: Elevation of Privilege.

Elevation of Privilege (EoP) occurs when an attacker gains access to resources or actions they are not authorized to use. In this case, the attacker can access resources—files, processes, session data, configuration settings, logs, etc.—that should be protected by authorization controls. The root cause is missing authorization or excessive privileges, violating the principle of least privilege. The consequence of such an action leads to Information Disclosure in most cases.

What can go wrong?

Such vulnerabilities can lead to unauthorized access to critical resources, potentially resulting in data breaches, system manipulation, and other security compromises.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

1. Implement comprehensive authorization checks for all resources, system component and requests, regardless of resource type. Ensure only appropriately privileged users can access them.
2. Adhere to the principle of least privilege, granting users only the permissions they need to perform their duties.
3. Regularly audit and review user privileges and resource access controls to identify and rectify any excesses or lapses in authorization.
4. Ensure client applications can only request access to what is strictly necessary.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.