Authorization (AZQ)

The key concept for this card is that inadequate input validation and privilege checks.

Scenario: Christopher’s Command Injection with Elevated Privileges

Imagine a situation where Christopher, exploiting system vulnerabilities, injects commands that the application executes at a higher privilege level. This occurs due to:

1. Elevated Privilege Execution: The application lacks proper controls to restrict command execution based on the user's privilege level.
2. Inadequate Command Filtering: Insufficient validation and filtering of user-submitted commands allow for execution of unauthorized commands.

Example

Christopher targets a web application with a feature that allows users to input commands for data retrieval. He discovers that this feature does not adequately validate or sanitize input, nor does it check the privilege level at which commands are executed. Exploiting this, he injects a command intended for administrative functions. The system, failing to restrict command execution based on user privileges, runs the command at an administrative level, allowing Christopher unauthorized access to sensitive system operations and data.

Threat Modeling

STRIDE

This scenario maps primarily to STRIDE: Elevation of Privilege (EoP).

Elevation of Privilege occurs when an attacker performs actions or executes commands beyond their authorized privileges. Christopher injects a command that the system executes at a higher privilege level than his own user role, gaining unauthorized administrative access. The attack exploits lack of privilege checks combined with command injection, allowing him to perform higher-privilege operations.

What can go wrong?

Such vulnerabilities can lead to unauthorized system access, data breaches, and potential control over critical system functionalities. This can manifest in various forms, including but not limited to:

• Unauthorized command execution with elevated privileges
• Log injection leading to unauthorized access or actions
• SQL injection that allows for unauthorized data manipulation or access
• LDAP injection that can lead to unauthorized access or changes in directory services
• XML injection that can lead to unauthorized access or manipulation of XML data
• OS command injection that allows attackers to execute arbitrary commands on the server with elevated privileges
• Remote code execution (RCE) that allows attackers to run arbitrary code on the server with elevated privileges
• File inclusion vulnerabilities that allow attackers to include and execute files on the server with elevated privileges
• Insecure deserialization that allows attackers to execute arbitrary code or commands with elevated privileges
• XPath injection that allows attackers to manipulate XML data and potentially execute commands with elevated privileges
• Script injection that allows attackers to execute scripts in the context of the application with elevated privileges
• Cross-site scripting (XSS) that allows attackers to execute scripts in the context of the application with elevated privileges
• Parameter pollution that allows attackers to manipulate parameters and potentially execute commands with elevated privileges
• IMAP injection that allows attackers to manipulate email data and potentially execute commands with elevated privileges
• NoSQL injection that allows attackers to manipulate NoSQL databases and potentially execute commands with elevated privileges

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

Firstly apply appropriate input validation and encoding. In cases where the application must run with elevated privileges, raise privileges as late as possible, and drop them as soon as possible.

1. Implement strict input validation and sanitization to prevent command injection attacks.
2. Ensure that all commands are executed only at the appropriate privilege level, preventing users from executing commands with elevated privileges.
3. Regularly review and update security protocols to safeguard against command injections and unauthorized privilege escalation.
4. Implement robust logging and monitoring to detect and respond to any unauthorized command execution attempts.
5. Conduct regular security testing, including penetration testing and code reviews, to identify and address potential vulnerabilities related to command injection and privilege escalation.
6. Implement mitigations such as using secure coding practices, employing least privilege principles, and utilizing security frameworks that provide built-in protections against command injection and privilege escalation.
7. Ensure input validation and encoding are applied consistently across all user inputs, especially those that interact with system commands or sensitive operations.
8. Consider implementing multiple layers of security, including continuous consumer identity verification, device security posture assessment, and contextual risk analysis when evaluating access to administrative interfaces or critical functions.
9. Only use recommended cryptographic functions and libraries for any operations that involve sensitive data or security controls, and ensure they are properly implemented to prevent vulnerabilities that could be exploited for command injection or privilege escalation.
10. Regularly audit and update security measures to maintain a high level of protection against evolving threats related to command injection and privilege escalation.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.