Description

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Extended Description

Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.

Applicable Platforms
Language Class: Language-independent

Time Of Introduction

• Architecture and Design
• Implementation
• Operation

Related Attack Patterns

• CAPEC-127
• CAPEC-87

Common Consequences

Detection Methods
None

Potential Mitigations

Relationships
Overlaps Modification of Assumed-Immutable Data (MAID), authorization errors, container errors; often primary to other weaknesses such as XSS and SQL injection.

Demonstrative Examples   (Details)

1. If forced browsing is possible, an attacker may be able to directly access a sensitive page by entering a URL similar to the following.

Observed Examples

1. CVE-2004-2144 : Bypass authentication via direct request.
2. CVE-2005-1892 : Infinite loop or infoleak triggered by direct requests.
3. CVE-2004-2257 : Bypass auth/auth via direct request.
4. CVE-2005-1688 : Direct request leads to infoleak by error.
5. CVE-2005-1697 : Direct request leads to infoleak by error.
6. CVE-2005-1698 : Direct request leads to infoleak by error.
7. CVE-2005-1685 : Authentication bypass via direct request.
8. CVE-2005-1827 : Authentication bypass via direct request.
9. CVE-2005-1654 : Authorization bypass using direct request.
10. CVE-2005-1668 : Access privileged functionality using direct request.
11. CVE-2002-1798 : Upload arbitrary files via direct request.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:
None