CISSP 21.5 - Exploiting Authorization Vulnerabilities

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series looks at how attackers exceed the access they were granted within Domain 8. It points to trusted community guidance on web risks, then walks through the authorization gaps that let ordinary users see and do what belongs to others, from object references to directory traversal and file inclusion.

Frequently Asked Questions

Where do we go for trusted guidance on web risks?

A great starting point is the Open Worldwide Application Security Project, a nonprofit and community focused on securing web applications. It freely shares methodology, tools, and techniques for better coding and safer deployment. Two resources are especially handy: a running list of the most critical web application risks, and a companion list of proactive controls to defend against them, either of which is a solid foundation for planning a security assessment or a penetration test.

What is an insecure direct object reference?

It happens when an application hands you data based purely on an identifier in your request, without checking whether you are allowed to have it. A link fetching a document by its number is fine as long as the app still verifies your permission, but if it does not, you can simply change that number and pull up documents that were never yours to see. The fix is straightforward: check authorization on every object, every time.

How does a directory traversal attack escape its boundaries?

Some servers are misconfigured so that users can wander the file system beyond the web content folder. On many systems, a special sequence in a path means go up one level, and by stringing that sequence together an attacker climbs out of the web folder to reach sensitive files, such as the file that stores hashed user passwords. If access controls do not stop them, the server displays that file in the browser, handing over a starting point for cracking credentials.

How does file inclusion turn browsing into code execution?

File inclusion takes traversal one step further by actually executing the code inside a file rather than just reading it. Local file inclusion runs a file already on the server, while remote file inclusion is worse, letting the attacker run code hosted on a completely different server they control. Once in, attackers often drop a web shell to run commands in the browser, and may even patch the original hole behind them to avoid detection and lock out rivals.

Why is authenticating a user never enough?

Authorization attacks are about exceeding the access you were given, often with no malware at all. Insecure direct object references let you swap an identifier to reach others’ data, directory traversal climbs out of the web folder to grab sensitive files, and file inclusion escalates browsing into remote code execution and web shells. In every case, confirming who a user is does not confirm what they may do, so you must authorize each action, not just authenticate the person.

Reference: This article is based on concepts discussed in CISSP 21.5 - Exploiting Authorization Vulnerabilities.