Contents
V5328. OWASP. Using non-restrictive authorization checks could lead to security violations.
The analyzer has detected a potential error related to weak user authorization verification. Granting unrestricted access to all users may lead to security vulnerabilities and unauthorized use of critical program features.
This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:
When verifying authorization, the decision-making method may deny authorization if users lack the required privileges. If the method implementation does not enforce access denial, it is insecure, making authorization verification unreliable.
For example, the vote method of the AccessDecisionVoter class always returns a positive response, even if users lack the required privileges:
@Override
public int vote(Authentication authentication,
FilterInvocation filterInvocation,
Collection<ConfigAttribute> attributes
) {
boolean isAdmin = hasAdminRole(authentication);
String requestMethod = filterInvocation.getRequest().getMethod();
if ("DELETE".equals(requestMethod) && !isAdmin) {
return ACCESS_GRANTED;
}
return ACCESS_GRANTED;
}Secure implementation should return at least one negative response:
@Override
public int vote(Authentication authentication,
FilterInvocation filterInvocation,
Collection<ConfigAttribute> attributes
) {
boolean isAdmin = hasAdminRole(authentication);
String requestMethod = filterInvocation.getRequest().getMethod();
if ("DELETE".equals(requestMethod) && !isAdmin) {
return ACCESS_DENIED;
}
return ACCESS_GRANTED;
}This diagnostic is classified as:
|
Was this page helpful?
