CWE-425 – Direct Request (‘Forced Browsing’)

Description

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.

Modes of Introduction:

– Architecture and Design

Related Weaknesses

CWE-862
CWE-862
CWE-288
CWE-424
CWE-471
CWE-98

Consequences

Confidentiality, Integrity, Availability, Access Control: Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity

Potential Mitigations

Phase: Architecture and Design, Operation

Description: 

Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

Phase: Architecture and Design

Description: 

Consider using MVC based frameworks such as Struts.

CVE References

• CVE-2004-2144
  • Bypass authentication via direct request.

• CVE-2005-1892
  • Infinite loop or infoleak triggered by direct requests.

• CVE-2004-2257
  • Bypass auth/auth via direct request.

• CVE-2005-1688
  • Direct request leads to infoleak by error.

• CVE-2005-1697
  • Direct request leads to infoleak by error.

• CVE-2005-1698
  • Direct request leads to infoleak by error.

• CVE-2005-1685
  • Authentication bypass via direct request.

• CVE-2005-1827
  • Authentication bypass via direct request.

• CVE-2005-1654
  • Authorization bypass using direct request.

• CVE-2005-1668
  • Access privileged functionality using direct request.

• CVE-2002-1798
  • Upload arbitrary files via direct request.