Difference between revisions of "OWASP Periodic Table of Vulnerabilities - Abuse of Functionality"

From OWASP
Jump to: navigation, search
Line 5: Line 5:
 
=== Root Cause Summary ===
 
=== Root Cause Summary ===
  
Abuse of functionality, sometimes referred to as business logic attacks involve the design and implementation for application functions and features.  As functionality is added to applications thought must be given to how the function or feature can be manipulated to circumvent the business process.  
+
Abuse of functionality, sometimes referred to as business logic attacks involve the design and implementation for application functions and features.  As functionality is added to applications, thought must be given to how the function or feature can be manipulated to circumvent the business process or abused to perform a function not intended by the developer.
  
 
Some examples include:
 
Some examples include:
*Cookie Manipulation
+
* Using a send-mail form to generate spam
*Predictive parameters
+
* Using a password reset flow to enumerate accounts
*Process timing
+
* Using a checkout form to issue a credit to a bank account, instead of debiting that account
*Lack of Data verification
+
*Premature approval
+
*Lack of process verification
+
  
 
=== Browser / Standards Solution ===
 
=== Browser / Standards Solution ===
Line 29: Line 26:
  
 
=== Custom Code Solution ===
 
=== Custom Code Solution ===
All functions and features of the application should be evaluated and tested against Use and Abuse cases to discover/uncover ways that potential attackers can use the application’s own functionality to circumvent the intended business process logic.  
+
All functions and features of the application should be tested against a comprehensive set of use and abuse cases to ensure that the application enables only the intended functionality and no more. Robust threat modeling exercises should be performed for each application feature to enumerate ways that attackers can abuse the feature.
  
 
=== Discussion / Controversy ===
 
=== Discussion / Controversy ===
Although there are some generic functionality to look for, uncovering abuse of functionality vulnerabilities can be difficult and is application specific since every application is different and each implements its functions and features differently. For this reason this type of testing is similar functional testing.  
+
Although there are some common abuse cases, vulnerabilities are generally application-specific and highly dependent on the features implemented by each application. If a generic solution can be implemented for a class of abuse, a separate vulnerability topic will exist to cover the solution.
  
  

Revision as of 13:22, 20 July 2013

Return to Periodic Table Working View

Contents

Abuse of Functionality

Root Cause Summary

Abuse of functionality, sometimes referred to as business logic attacks involve the design and implementation for application functions and features. As functionality is added to applications, thought must be given to how the function or feature can be manipulated to circumvent the business process or abused to perform a function not intended by the developer.

Some examples include:

  • Using a send-mail form to generate spam
  • Using a password reset flow to enumerate accounts
  • Using a checkout form to issue a credit to a bank account, instead of debiting that account

Browser / Standards Solution

None

Perimeter Solution

None

Generic Framework Solution

None

Custom Framework Solution

None

Custom Code Solution

All functions and features of the application should be tested against a comprehensive set of use and abuse cases to ensure that the application enables only the intended functionality and no more. Robust threat modeling exercises should be performed for each application feature to enumerate ways that attackers can abuse the feature.

Discussion / Controversy

Although there are some common abuse cases, vulnerabilities are generally application-specific and highly dependent on the features implemented by each application. If a generic solution can be implemented for a class of abuse, a separate vulnerability topic will exist to cover the solution.


References

WASC Abuse of Functionality

CAPEC – 210: Abuse of Functionality>

OWASP Category: Abuse of Functionality

OWASP Business Logic Cheat Sheet

OWASP Testing Guide – Testing for business Logic (OWASP-BL-001)