When an actor tries to access a resource or conduct an action, the software does not complete an authorization check.
Authorization evaluates whether a user with a given identity can access a shared resource based on the user's privileges and any rights or other access-control criteria that apply to the asset. Users can access data or conduct actions that they shouldn't be able to do if access control measures aren't in place. This can result in various issues, including data leakage, denial of service, and arbitrary code execution.
This flaw arises from a neglected security approach during the architecture and design process. Authorization defects may occur when a single-user application is switched to a multi-user environment. A developer may create authorization flaws because of a lack of awareness of the underlying technologies. For example, a developer might believe that attackers won't be able to change particular inputs like headers or cookies.
An attacker could read sensitive data by reading it straight from an unrestricted data store or by using improperly protected privileged functionality.
An attacker may be able to gain access to, edit, or delete data for which they are not allowed. This can be pretty harmless (for example, seeing an admin console landing page but not being able to see any data) or extremely dangerous (for example (e.g. complete visibility into user data).
Separate the software into four sections: anonymous, regular, privileged, and administrative. You may reduce the attack surface by mapping roles to data and functions adequately.
Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Use a well-tested library or framework to prevent this flaw from arising or provide constructs that make it easy to avoid. Consider employing authorization frameworks like the JAAS Authorization Framework, for example.
Confirm that the business logic carries out access control checks. These tests may differ from access control checks performed on more general resources such as files, connections, processes, RAM, and database records.