Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Terminoloji

Alternatif adlar ve kullanım biçimleri

forced browsing

The "forced browsing" term could be misinterpreted to include weaknesses such as CSRF or XSS, so its use is discouraged.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.

Yaşam döngüsü evresi

Operation

Risk

Başarılı sömürü neye yol açar?

Read Application DataModify Application DataExecute Unauthorized Code or CommandsGain Privileges or Assume Identity

Etkilenen güvenlik alanları: Confidentiality, Integrity, Availability, Access Control

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design · Operation

Birden fazla yaşam döngüsü evresinde uygulanacak savunma

Detay

Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay

Consider using MVC based frameworks such as Struts.

MITRE görseli

Zafiyet ilişkisi ve akışı