CWE-863: Incorrect Authorization

What is Incorrect Authorization?

• Overview: Incorrect Authorization (CWE-863) occurs when a software system performs an authorization check to control access to resources or actions but fails to implement it correctly, allowing unauthorized access or actions.

• Exploitation Methods:

• Attackers can exploit this vulnerability by bypassing authorization checks to access restricted resources or perform unauthorized actions.
• Common attack patterns include manipulating request parameters, exploiting insufficient access control logic, and leveraging predictable resource identifiers.

• Security Impact:

• Direct consequences of successful exploitation include unauthorized access to sensitive data, unauthorized execution of actions, and privilege escalation.
• Potential cascading effects involve data breaches, loss of data integrity, and exposure of confidential information.
• Business impact can include reputational damage, legal consequences, financial losses, and erosion of customer trust.

• Prevention Guidelines:

• Specific code-level fixes include implementing robust access control mechanisms and ensuring authorization checks are performed consistently and correctly for all resource accesses and actions.
• Security best practices involve following the principle of least privilege, regularly reviewing and updating access control policies, and conducting thorough security audits.
• Recommended tools and frameworks include using established access control libraries, employing security testing tools to identify authorization flaws, and integrating security into the development lifecycle.

Corgea can automatically detect and fix Incorrect Authorization in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: High

Affected Languages: Not Language-Specific

Affected Technologies: Web Server, Database Server

An access control list (ACL) represents who/what has permissions to a given object. Different operating systems implement (ACLs) in different ways. In UNIX, there are three types of permissions: read, write, and execute. Users are divided into three classes for file access: owner, group owner, and all other users where each class has a separate set of rights. In Windows NT, there are four basic types of permissions for files: "No access", "Read access", "Change access", and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list of users and groups along with their associated permissions. A user can create an object (file) and assign specified permissions to that object.

Vulnerable Code Example

Python Example

from flask import Flask, request, jsonify

app = Flask(__name__)

# Simulated data store
users = {
    "alice": {"role": "admin", "data": "Sensitive admin data"},
    "bob": {"role": "user", "data": "General user data"}
}

@app.route('/data', methods=['GET'])
def get_data():
    # Vulnerable: Authorization based on user input without checking session or token
    username = request.args.get('username')
    if username in users:
        return jsonify({"data": users[username]["data"]})
    else:
        return jsonify({"error": "User not found"}), 404

if __name__ == '__main__':
    app.run()

Explanation:

In this example, the authorization check is weak because it relies solely on a username parameter from the HTTP request. This means an attacker can access any user's data by providing their username in the username query parameter, bypassing proper authorization checks. This exposes sensitive data and violates the principle of least privilege.

How to fix Incorrect Authorization?

To correct this vulnerability, implement a robust authentication and authorization mechanism:

1. Authentication: Verify user identity through session management or token-based systems like JWT (JSON Web Tokens).

2. Authorization: Ensure that, once authenticated, the user has the necessary permissions to access the requested resource.

3. Session Management: Use server-side sessions to track authenticated users and their roles securely.

4. Principle of Least Privilege: Ensure users can only access resources necessary for their role.

Fixed Code Example

from flask import Flask, request, jsonify, session
from functools import wraps

app = Flask(__name__)
app.secret_key = 'super_secret_key'  # Secret key for session management

# Simulated data store
users = {
    "alice": {"role": "admin", "data": "Sensitive admin data"},
    "bob": {"role": "user", "data": "General user data"}
}

# Authentication check decorator
def login_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'username' not in session:
            return jsonify({"error": "Authentication required"}), 401
        return f(*args, **kwargs)
    return decorated_function

# Authorization check decorator
def role_required(role):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            username = session.get('username')
            if users.get(username, {}).get('role') != role:
                return jsonify({"error": "Unauthorized access"}), 403
            return f(*args, **kwargs)
        return decorated_function
    return decorator

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    if username in users:
        session['username'] = username
        return jsonify({"message": "Login successful"})
    else:
        return jsonify({"error": "Invalid credentials"}), 401

@app.route('/data', methods=['GET'])
@login_required
@role_required('admin')
def get_data():
    username = session['username']
    return jsonify({"data": users[username]["data"]})

if __name__ == '__main__':
    app.run()

Explanation:

The fixed code introduces:

• Session Management: Users must log in to establish a session, which securely tracks the user's identity and role.
• Authentication: A /login route is added to authenticate users, storing their username in the session upon successful login.
• Authorization: Role-based access control is implemented using the role_required decorator to ensure only users with the appropriate role can access certain resources.
• Security Decorators: login_required and role_required decorators are used to enforce authentication and authorization checks, ensuring that only authenticated and authorized users can access sensitive data.

This revised structure effectively prevents unauthorized access by ensuring that only authenticated and authorized users can access sensitive data, adhering to the principle of least privilege.