OWASP #1: Broken Access Control

📋 What Is It?

Broken Access Control occurs when users can access data or perform actions beyond their intended permissions. This is the #1 vulnerability in OWASP Top 10 2021.

#1 OWASP Rank

94% Apps Tested

318K Occurrences

⚠️ Common Exploits

Direct Object Reference: Modify URL parameters to access other users' data
Forced Browsing: Access admin pages by guessing URLs
Missing Function Level Access Control: Call admin APIs as regular user
Parameter Tampering: Change user_id, role, or permissions in requests
Elevation of Privilege: Modify tokens/cookies to gain higher access

🔴 Attack Flow

1. Attacker logs in as regular user
↓
2. Observes admin button in HTML source
↓
3. Accesses /admin endpoint directly
↓
4. Server doesn't verify authorization
↓
5. BREACH: Admin access granted!

❌ Vulnerable Code

// Bad: No authorization check!
@app.route('/user/<user_id>/profile')
def view_profile(user_id):
    # Anyone can view any profile!
    user = User.query.get(user_id)
    return render_template('profile.html', user=user)

// Bad: Client-side access control
<button id="adminButton" style="display: none;">Admin Panel</button>
                

✅ Secure Code

// Good: Proper authorization check
@app.route('/user/<user_id>/profile')
@login_required
def view_profile(user_id):
    user = User.query.get(user_id)
    
    # Verify user can access this profile
    if current_user.id != user_id and not current_user.is_admin:
        abort(403)  # Forbidden
    
    return render_template('profile.html', user=user)

// Good: Server-side authorization
@app.route('/admin')
@login_required
@admin_required  # Decorator checks admin role
def admin_panel():
    return render_template('admin.html')
                

✓ Prevention Checklist

Deny access by default (whitelist approach)
Implement server-side authorization checks
Use role-based access control (RBAC)
Validate user ownership of resources
Implement rate limiting for sensitive operations
Log access control failures
Disable directory listing
Use indirect object references (UUIDs)
Test with automated tools
Review authorization logic in code reviews

🔍 Detection & Tools

Testing Tools:

Burp Suite OWASP ZAP Postman curl

Prevention Tools:

Spring Security Django Auth Passport.js Casbin

How to Test:

Try accessing URLs as different users
Modify IDs in parameters
Test with roles disabled
Check for forced browsing

🌍 Real-World Breaches

Equifax (2017): Exposed 147M records due to broken access controls
Facebook (2019): 540M records exposed on unprotected AWS bucket
Uber (2016): Driver access to rider data without proper controls
T-Mobile (2021): API vulnerability allowed access to customer data

📌 Quick Tips

DO NOT rely on client-side checks
DO NOT use sequential IDs for sensitive resources
DO implement authorization on every request
DO use the principle of least privilege
DO log and monitor access attempts

📜 Compliance

Related Standards:

PCI-DSS Requirement 6.5.8
GDPR Art. 32 - Security
SOC 2 CC6.1, CC6.3
ISO 27001 A.9.4
NIST 800-53 AC-3

🛡️ Broken Access Control