COMMON WEAKNESS ENUMERATIONIncomplete

CWE-425

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Terminology

Alternate terms and usages

forced browsing

The "forced browsing" term could be misinterpreted to include weaknesses such as CSRF or XSS, so its use is discouraged.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.

Lifecycle phase

Operation

Risk

What does successful exploitation lead to?

Read Application DataModify Application DataExecute Unauthorized Code or CommandsGain Privileges or Assume Identity

Affected security scopes: Confidentiality, Integrity, Availability, Access Control

Defence

How is it prevented and fixed?

Architecture and Design · Operation

Defence to apply across several lifecycle phases

Detail
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

Architecture and Design

Architecture and design approach

Detail
Consider using MVC based frameworks such as Struts.

MITRE diagram

Weakness relationships and flow

CWE-425 MITRE diagramı