the-web-application-hackers-handbook

Chapter 8 n Attacking Access Controls 259
n Horizontal privilege escalation occurs when a user can view or modify
resources to which he is not entitled. For example, if you can use a web
mail application to read other people’s e-mail, or if a payment clerk can
process invoices for an organizational unit other than his own, access
controls are broken.
n Business logic exploitation occurs when a user can exploit a flaw in the
application’s state machine to gain access to a key resource. For example,
a user may be able to bypass the payment step in a shopping checkout
sequence.
It is common to find cases where vulnerability in the application’s horizontal
separation of privileges can lead immediately to a vertical escalation attack. For
example, if a user finds a way to set a different user’s password, the user can
attack an administrative account and take control of the application.
In the cases described so far, broken access controls enable users who have
authenticated themselves to the application in a particular user context to perform
actions or access data for which that context does not authorize them.
However, in the most serious cases of broken access control, it may be possible
for completely unauthorized users to gain access to functionality or data that
is intended to be accessed only by privileged authenticated users.
Completely Unprotected Functionality
In many cases of broken access controls, sensitive functionality and resources
can be accessed by anyone who knows the relevant URL. For example, with
many applications, anyone who visits a specific URL can make full use of its
administrative functions:
https://wahh-app.com/admin/
In this situation, the application typically enforces access control only to the
following extent: users who have logged in as administrators see a link to this
URL on their user interface, and other users do not. This cosmetic difference
is the only mechanism in place to “protect” the sensitive functionality from
unauthorized use.
Sometimes, the URL that grants access to powerful functions may be less
easy to guess, and may even be quite cryptic:
https://wahh-app.com/menus/secure/ff457/DoAdminMenu2.jsp
Here, access to administrative functions is protected by the assumption that
an attacker will not know or discover this URL. The application is harder for
an outsider to compromise, because he is less likely to guess the URL by which
he can do so.