Top 10 2010-A8-Failure to Restrict URL Access

The attacker simply force browses to target URLs. Consider the following URLs which are both supposed to require authentication. Admin rights are also required for access to the “admin_getappInfo” page. http://example.com/app/getappInfo http://example.com/app/admin_getappInfo If the attacker is not authenticated, and access to either page is granted, then unauthorized access was allowed. If an authenticated, non-admin, user is allowed to access the “admin_getappInfo” page, this is a flaw, and may lead the attacker to more improperly protected admin pages.

Such flaws are frequently introduced when links and buttons are simply not displayed to unauthorized users, but the application fails to protect the pages they target.

For additional access control requirements, see the ASVS requirements area for Access Control (V4)
 * OWASP Top 10-2007 on Failure to Restrict URL Access
 * ESAPI Access Control API
 * OWASP Development Guide: Chapter on Authorization
 * OWASP Testing Guide: Testing for Path Traversal
 * OWASP Article on Forced Browsing

CWE Entry 285 on Improper Access Control (Authorization)