AUTHORIZATION (AZ4)
Kelly can bypass authorization controls because they do not fail securely (i.e. they default to allowing access)
Kelly can bypass authorization controls because they do not fail securely (i.e. they default to allowing access)
OWASP SCP
79,80
OWASP ASVS
4.1.5
OWASP AppSensor
CAPEC
-
SAFECODE
8,10,11
Once an authorization failure is detected, access needs to be blocked. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.
NB: the key concept for this card is allowing access, even though authorization checks were undertaken and detected a failure. See AT 8 for the similar authentication failure.
Mappings
OWASP ASVS (4.0): 4.1.5
Capec: 122
OWASP SCP: 79,80
OWASP Appsensor:
Safecode: 8,10,11
ASVS (4.0) Cheatsheetseries Index
ASVS V4.1 - General Access Control Design
No suitable mappings were found.
