10. Failure to Restrict URL Access
{"Image DocumentName": "10. Failure to Restrict URL Access", "Image ImageDescription": "Vulnerabilities. Forced browsing. Hidden URLs and files. Outdated security mechanism. Evaluating privileges only on the client. Vulnerability. The primary attack method for this vulnerability is called forced browsing , which encompasses guessing links and brute force techniques to find unprotected pages. Applications frequently allow access control code to evolve and spread throughout a codebase, resulting in a complex model that is difficult to understand for developers and security specialists alike. This complexity makes it likely that errors will occur and pages will be missed, leaving them exposed. Some common examples of these flaws include: Hidden or special URLs, rendered only to administrators or privileged users in the presentation layer, but accessible to all users if they know it exists, such as /admin/adduser.php or /approveTransfer.do. This is particularly prevalent with menu code. Applications often allow access to hidden files, such as static XML or system generated reports, trusting security through obscurity to hide them. Code that enforces an access control policy but is out of date or insufficient. For example, imagine /approveTransfer.do was once available to all users, but since SOX controls were brought in, it is only supposed to be available to approvers. A fix might have been to not present it to unauthorized users, but no access control is actually enforced when requesting that page. Code that evaluates privileges on the client but not on the server, as in this attack on MacWorld 2007, which approved Platinum passes worth  1700 via JavaScript on the browser rather than on the server.", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}