1287
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Assume all input is malicious. Use a standard input validation mechanism to validate all input for
length, type, syntax, and business rules before accepting the data. Use an "accept known good"
validation strategy.
Phase: Implementation
Use a parameterized query AND make sure that the accepted values conform to the business
rules. Construct your SQL statement accordingly.
Demonstrative Examples
Example 1:
The following code uses a parameterized statement, which escapes metacharacters and prevents
SQL injection vulnerabilities, to construct and execute a SQL query that searches for an invoice
matching the specified identifier [1]. The identifier is selected from a list of all invoices associated
with the current authenticated user.
Example Language: C# (Bad)
...
conn = new SqlConnection(_ConnectionString);
conn.Open();
int16 id = System.Convert.ToInt16(invoiceID.Text);
SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn);
query.Parameters.AddWithValue("@id", id);
SqlDataReader objReader = objCommand.ExecuteReader();
...
The problem is that the developer has not considered all of the possible values of id. Although
the interface generates a list of invoice identifiers that belong to the current user, an attacker can
bypass this interface to request any desired invoice. Because the code in this example does not
check to ensure that the user has permission to access the requested invoice, it will display any
invoice, even if it does not belong to the current user.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 994 SFP Secondary Cluster: Tainted Input to Variable 888 2417
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
CWE Version 4.14
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context