1408
Broken Object Level Authorization / BOLA : BOLA is used in the 2019 OWASP API Security
Top 10 and is said to be the same as IDOR.
Horizontal Authorization : "Horizontal Authorization" is used to describe situations in which two
users have the same privilege level, but must be prevented from accessing each other's resources.
This is fairly common when using key-based access to resources in a multi-user context.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Access control checks for specific user data or functionality
can be bypassed.
Access Control Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can
view/modify information of another user).
Access Control Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the usercontrolled
key is actually a flag that indicates administrator
status, allowing the attacker to gain administrative access.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the
record that is being requested.
Phase: Architecture and Design
Phase: Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable
externally by the user or that any tampering can be detected.
Phase: Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or
associate a digital signature with the key so that the server can verify that there has been no
tampering.
Demonstrative Examples
Example 1:
The following code uses a parameterized statement, which escapes metacharacters and prevents
SQL injection vulnerabilities, to construct and execute a SQL query that searches for an invoice
CWE Version 4.14
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CWE-640: Weak Password Recovery Mechanism for Forgotten Password