Authorization (AZ8)

The key concept is being able to alter the normal sequence of operations, manipulating parameters, or changing date/time values which allows modifying the intended process or control data.

Scenario: Tom’s Manipulation of Process Sequences and Control Data

Imagine a scenario where Tom bypasses established business rules by altering the normal sequence or flow of processes within an application. He exploits system vulnerabilities such as:

1. Altering Process Sequence: Tom changes the usual order of operations in a process.
2. Manipulating Date and Time Values: He adjusts date and time values used by the application to circumvent restrictions or trigger unintended behaviors.
3. Misusing Valid Features: Tom uses application features for purposes other than their intended use.
4. Manipulating Control Data: He alters data that the application uses to control process flow or decision-making.

Example

Tom targets an online shopping platform where users are required to finalize their shopping cart before proceeding to checkout. However, by manipulating the URL parameters and submitting POST requests out of the intended sequence, he bypasses certain checks, adding items to the cart at discounted prices post-confirmation. He also adjusts the system's date and time parameters to access time-limited special offers. This manipulation allows Tom to exploit the application's features and control data for unintended benefits.

Threat Modeling

STRIDE

This scenario maps primarily to STRIDE: Elevation of Privilege through the use of Tampering.

Tampering involves unauthorized modification or manipulation of data, processes, or control flow. Tom bypasses business rules by altering the normal sequence of operations, manipulating parameters, or changing date/time values, which allows him to exploit the application. The attack is focused on modifying the intended process or control data, which is classic Tampering, but by bypassing rules or manipulating time, Tom effectively escalates his privileges, e.g., the system treats him as if he is eligible for the time-limited offer which mean that the primary impact in many such Tampering cases is Elevation of Privilege.

What can go wrong?

Such vulnerabilities can lead to process integrity breaches, unauthorized access to restricted functionalities, and potential financial losses or data inconsistencies.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

Do not make assumptions about the order or previous actions of a user. Re-perform authorization checks at each and every step.

1. Design the system to strictly enforce the intended sequence and flow of processes.
2. Validate all control data, including date and time parameters, to ensure they have not been tampered with.
3. Limit the ability to manipulate URLs and direct requests that can alter the normal application flow.
4. Regularly review and test the application for potential misuse of features and control data manipulations.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.