CAPEC-180

Exploiting Incorrectly Configured Access Control Security Levels
High
Medium
Draft
2014-06-23
00h00 +00:00
2022-09-29
00h00 +00:00
CAPEC Mitre.org
Alerte pour un CAPEC
Stay informed of any changes for a specific CAPEC.
Notifications manage

Descriptions CAPEC

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

Informations CAPEC

Execution Flow

1) Explore

[Survey] The attacker surveys the target application, possibly as a valid and authenticated user.

Technique
  • Spider the web site for all available links.
  • Brute force to guess all function names/action with different privileges.
2) Experiment

[Identify weak points in access control configurations] The attacker probes the access control for functions and data identified in the Explore phase to identify potential weaknesses in how the access controls are configured.

Technique
  • The attacker attempts authenticated access to targeted functions and data.
  • The attacker attempts unauthenticated access to targeted functions and data.
  • The attacker attempts indirect and side channel access to targeted functions and data.
3) Exploit

[Access the function or data bypassing the access control] The attacker executes the function or accesses the data identified in the Explore phase bypassing the access control.

Technique
  • The attacker executes the function or accesses the data not authorized to them.

Prerequisites

The target must apply access controls, but incorrectly configure them. However, not all incorrect configurations can be exploited by an attacker. If the incorrect configuration applies too little security to some functionality, then the attacker may be able to exploit it if the access control would be the only thing preventing an attacker's access and it no longer does so. If the incorrect configuration applies too much security, it must prevent legitimate activity and the attacker must be able to force others to require this activity..

Skills Required

In order to discover unrestricted resources, the attacker does not need special tools or skills. They only have to observe the resources or access mechanisms invoked as each action is performed and then try and access those access mechanisms directly.

Resources Required

None: No specialized resources are required to execute this type of attack.

Mitigations

Design: Configure the access control correctly.

Related Weaknesses

CWE-ID Weakness Name

CWE-732

 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

CWE-1190

 DMA Device Enabled Too Early in Boot Phase
The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.

CWE-1191

 On-Chip Debug and Test Interface With Improper Access Control
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

CWE-1193

 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.

CWE-1220

 Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

CWE-1268

 Policy Privileges are not Assigned Consistently Between Control and Data Agents
The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.

CWE-1280

 Access Control Check Implemented After Asset is Accessed
A product's hardware-based access control check occurs after the asset has been accessed.

CWE-1297

 Unprotected Confidential Information on Device is Accessible by OSAT Vendors
The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors.

CWE-1311

 Improper Translation of Security Attributes by Fabric Bridge
The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.

CWE-1315

 Improper Setting of Bus Controlling Capability in Fabric End-point
The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.

CWE-1318

 Missing Support for Security Features in On-chip Fabrics or Buses
On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.

CWE-1320

 Improper Protection for Outbound Error Messages and Alert Signals
Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.

CWE-1321

 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References

REF-29

Share Library Call Redirection Via ELF PLT Infection
Silvio Cesare.
http://phrack.org/issues/56/7.html

REF-30

OWASP Top 10 2007
https://www.owasp.org/www-pdf-archive/OWASP_Top_10_2007.pdf

Submission

Name Organization Date Date release
CAPEC Content Team The MITRE Corporation 2014-06-23 +00:00

Modifications

Name Organization Date Comment
CAPEC Content Team The MITRE Corporation 2015-11-09 +00:00 Updated Attack_Phases
CAPEC Content Team The MITRE Corporation 2015-12-07 +00:00 Updated Attack_Phases
CAPEC Content Team The MITRE Corporation 2017-01-09 +00:00 Updated Attack_Phases
CAPEC Content Team The MITRE Corporation 2017-05-01 +00:00 Updated Attack_Phases
CAPEC Content Team The MITRE Corporation 2017-08-04 +00:00 Updated Attack_Phases, Resources_Required
CAPEC Content Team The MITRE Corporation 2018-07-31 +00:00 Updated Attack_Phases, References
CAPEC Content Team The MITRE Corporation 2019-04-04 +00:00 Updated Consequences
CAPEC Content Team The MITRE Corporation 2020-07-30 +00:00 Updated Execution_Flow, Related_Weaknesses, Skills_Required
CAPEC Content Team The MITRE Corporation 2020-12-17 +00:00 Updated References, Related_Attack_Patterns, Related_Weaknesses
CAPEC Content Team The MITRE Corporation 2021-06-24 +00:00 Updated Related_Weaknesses
CAPEC Content Team The MITRE Corporation 2021-10-21 +00:00 Updated Related_Weaknesses
CAPEC Content Team The MITRE Corporation 2022-02-22 +00:00 Updated Description, Extended_Description
CAPEC Content Team The MITRE Corporation 2022-09-29 +00:00 Updated Related_Weaknesses, Taxonomy_Mappings