the-web-application-hackers-handbook

Chapter 8 n Attacking Access Controls 283
necessary to carry out the actions that group is permitted to perform.
Declarative controls of this kind are declared from outside the application.
This is a useful application of defense-in-depth principles, because
privileges are imposed on the application by a different component. Even
if a user finds a way to breach the access controls implemented within the
application tier in order to perform a sensitive action, such as adding a
new user, he is prevented from doing so. The database account that he is
using does not have the required privileges within the database.
A different means of applying declarative access control exists at the
application server level, via deployment descriptor files, which are applied
during application deployment. However, these can be relatively blunt
instruments and do not always scale well to manage fine-grained privileges
in a large application.
HACK STEPS
If you are attacking an application that employs a multilayered privilege
model of this kind, it is likely that many of the most obvious mistakes that
are commonly made in applying access controls will be defended against. You
may find that circumventing the controls implemented within the application
does not get you very far, because of protection in place at other layers. With
this in mind, several potential lines of attack are still available to you. Most
importantly, understanding the limitations of each type of control, in terms of
the protection it does not offer, will help you identify the vulnerabilities that
are most likely to affect it:
n Programmatic checks within the application layer may be susceptible to
injection-based attacks.
n Roles defined at the application server layer are often coarsely defined
and may be incomplete.
n Where application components run using low-privileged operating system
accounts, typically they can read many kinds of potentially sensitive
data within the host file system. Any vulnerabilities granting arbitrary file
access may still be usefully exploited, even if only to read sensitive data.
n Vulnerabilities within the application server software itself typically
enable you to defeat all access controls implemented within the application
layer, but you may still have limited access to the database and
operating system.
n A single exploitable access control vulnerability in the right location may
still provide a starting point for serious privilege escalation. For example,
if you discover a way to modify the role associated with your account,
you may find that logging in again with that account gives you enhanced
access at both the application and database layers.