Broken Access Control
What is broken access control ?
Broken Access Control refers to thoes vulnerabilities that allow users to perform actions or access information they are not authorized to. This can lead to unauthorized information disclosure, modification, or destruction, and unintended tasks.
- Violation of the Principle of Least Privilege
- Bypassing Access Control Checks
- Insecure Direct Object References
- Missing Access Controls on APIs
- Elevation of Privilege
- Metadata Manipulation
- CORS Misconfiguration
- Force Browsing
Some types of broken access control :
- Bypassing Authentication by Manipulating URL or HTTP Parameters
- Inadequate Session Management
- Forced Browsing to Access Restricted Resources
- Lack of Access Control Checks on APIs