Privilege Management: Amazon Web Services Unchecked Permissions

ABSTRACT

攻擊者可利用控制權限或 access control 列表的方法未經檢驗的參數來訪問敏感數據。

EXPLANATION

攻擊者可通過下列方法來利用未經檢驗的權限中的漏洞：

1. 數據從不可信賴的數據源進入應用程序。

2. 事先未經過任何健全性檢查，此數據即用于表示用戶或組標識符、權限列表或應用權限的資源。應用程序隨后會使用這些未經檢查的數據來編輯權限設置。

REFERENCES

[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A2 Broken Access Control

[2] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A6 Security Misconfiguration

[3] Standards Mapping - FIPS200 - (FISMA) AC

[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3500 CAT II

[5] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3500 CAT II

[6] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 265

[7] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Improper Access Control - CWE ID 285