Broken Access Control
Users can act outside of their intended permissions, typically leading to unauthorized information disclosure, modification, or destruction of data. The most common ways in which it's presented are:
IDOR: Insecure Direct Object Reference, when an application fails to secure access to restringed data to a user
Weak authorization: Fail to protect sensitive content. For example, secure the admin page with a readable cookie
Security through obscurity: Try to hide secret information in paths that seem not to be visible
File Inclusion: Setting routes via URL to access system files or redirecting to other pages
We can find a typical example of this vulnerability as follows:
URL contains an enumeration of internal objects
Last updated
Was this helpful?