A7 Missing Function Level Access Control

In a web application with different user roles, authentication is not enough. Each request must be controlled against user's role to ensure the user is authorized to use the requested function or access the requested page.

Possible Attacks:

• Privilege Escalation
• Directory Browising

Impact on Security:

• Attack on Confidentiality
• Attack on Integrity
• Attack on Availability

Exploitability   : Easy

Detectability   : Average

Impact            : Moderate

Possible Mitigation:

1. Deny all access by default. Check if user has permission to access then allow.
2. If the function is invoked in a workflow, check to make sure the conditions are in the proper state to allow access.
3. The enforcement mechanism should deny all access by default, requiring explicit grants to specific roles for access to every function.