Skip to main content

2024 | OriginalPaper | Buchkapitel

An Investigation of Broken Access Control Types, Vulnerabilities, Protection, and Security

verfasst von : Elaf Almushiti, Raseel Zaki, Nora Thamer, Rima Alshaya

Erschienen in: Advances in Emerging Information and Communication Technology

Verlag: Springer Nature Switzerland

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

In the OWASP Top 10 Version 2021, the Broken Access Control is ranked first position. That means it is the most exploited vulnerability today by attackers. Because if the attacker can break the access control, he can take administrator privileges and compromise the entire web application. After that, he can launch any type of attack for his purpose. That was the cause of why it was most targeted. In this search, we will present the Broken Access Control vulnerability. First, we talk about its history and then present an overview. After that, we show some research related to our search. Then we reviewed the web application vulnerabilities that attackers may exploit to break the access control. Finally, we talk about protection and security that should be taken against attackers who exploit this vulnerability.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
1.
Zurück zum Zitat THE OWASP®. OWASP Foundation, the Open Source Foundation for Application Security—OWASP Foundation. (n.d.), https://owasp.org/. Last accessed 20 Sept 2023 THE OWASP®. OWASP Foundation, the Open Source Foundation for Application Security—OWASP Foundation. (n.d.), https://​owasp.​org/​. Last accessed 20 Sept 2023
2.
Zurück zum Zitat A. Alotaibi, L. Alghufaili, D.M. Ibrahim, Cross site scripting attack review. ISC Int. J. Inf. Secur. 13(3), 21–30 (2021) A. Alotaibi, L. Alghufaili, D.M. Ibrahim, Cross site scripting attack review. ISC Int. J. Inf. Secur. 13(3), 21–30 (2021)
4.
Zurück zum Zitat M.S. Albulayhi, D.M. Ibrahim, Open web application security project components with known vulnerabilities: a comprehensive study. ISC Int. J. Inf. Secur. 13(3), 59–67 (2021) M.S. Albulayhi, D.M. Ibrahim, Open web application security project components with known vulnerabilities: a comprehensive study. ISC Int. J. Inf. Secur. 13(3), 59–67 (2021)
5.
Zurück zum Zitat S. Alotaibi, K. Alharbi, B. Abaalkhail, D.M. Ibrahim, Sensitive data exposure: data forwarding and storage on cloud environment. Int. J. Online Biomed. Eng. 17(14), 4–18 (2021)CrossRef S. Alotaibi, K. Alharbi, B. Abaalkhail, D.M. Ibrahim, Sensitive data exposure: data forwarding and storage on cloud environment. Int. J. Online Biomed. Eng. 17(14), 4–18 (2021)CrossRef
6.
Zurück zum Zitat A.H. Alrobaish, W.F. Al-mutairi, H.A. Alsuqayhi, D.M. Ibrahim, Common attacks on near field communication technology, in 2nd International Conference on Computing and Information Technology (ICCIT), (IEEE, Tabuk, 2022), pp. 110–114 A.H. Alrobaish, W.F. Al-mutairi, H.A. Alsuqayhi, D.M. Ibrahim, Common attacks on near field communication technology, in 2nd International Conference on Computing and Information Technology (ICCIT), (IEEE, Tabuk, 2022), pp. 110–114
7.
Zurück zum Zitat M.M. Hassan, M.A. Ali, T. Bhuiyan, S. Biswas, Quantitative assessment on broken access control vulnerability in web applications, in International Conference on Cyber Security and Computer Science 2018, (2018) M.M. Hassan, M.A. Ali, T. Bhuiyan, S. Biswas, Quantitative assessment on broken access control vulnerability in web applications, in International Conference on Cyber Security and Computer Science 2018, (2018)
9.
Zurück zum Zitat H. Aljoaey, K. Almutawa, R. Alabdali, D.M. Ibrahim, Broken authentication and session management vulnerabilities. ISC Int. J. Inf. Secur. 13(3), 11–19 (2021) H. Aljoaey, K. Almutawa, R. Alabdali, D.M. Ibrahim, Broken authentication and session management vulnerabilities. ISC Int. J. Inf. Secur. 13(3), 11–19 (2021)
10.
Zurück zum Zitat D. Stuttard, P. Marcus, The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws (Wiley, 2011) D. Stuttard, P. Marcus, The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws (Wiley, 2011)
11.
Zurück zum Zitat K. Pan, amp; Wang, Q., Static detection of access control vulnerabilities in vue applications. J. Phys. Conf. Ser. 1646(1), 012021 (2020)CrossRef K. Pan, amp; Wang, Q., Static detection of access control vulnerabilities in vue applications. J. Phys. Conf. Ser. 1646(1), 012021 (2020)CrossRef
12.
Zurück zum Zitat M. Alsalamah, H. Alwabli, H. Alqwifli, D.M. Ibrahim, A review study on SQL injection attacks, prevention, and detection. ISC Int. J. Inf. Secur. 13(3), 1–10 (2021) M. Alsalamah, H. Alwabli, H. Alqwifli, D.M. Ibrahim, A review study on SQL injection attacks, prevention, and detection. ISC Int. J. Inf. Secur. 13(3), 1–10 (2021)
13.
Zurück zum Zitat H.G. Song, Y. Kim, K.G. Doh, Automatic detection of access control vulnerabilities in web applications by URL crawling and forced browsing. Inf. Sci. Technol. 3(2), 482–486 (2012) H.G. Song, Y. Kim, K.G. Doh, Automatic detection of access control vulnerabilities in web applications by URL crawling and forced browsing. Inf. Sci. Technol. 3(2), 482–486 (2012)
14.
Zurück zum Zitat F. Sun, L. Xu, Z. Su, Static detection of access control vulnerabilities in web applications, in 20th USENIX Security Symposium (USENIX Security 11), 64(1) (2011) F. Sun, L. Xu, Z. Su, Static detection of access control vulnerabilities in web applications, in 20th USENIX Security Symposium (USENIX Security 11), 64(1) (2011)
17.
Zurück zum Zitat D. Stuttard, M. Pinto, J.J. Pauli, The web application hacker’s Handbook: Finding and exploiting security flaws (Wiley, 2012) D. Stuttard, M. Pinto, J.J. Pauli, The web application hacker’s Handbook: Finding and exploiting security flaws (Wiley, 2012)
19.
Zurück zum Zitat M. Rennhard, M. Kushnir, O. Favre, D. Esposito, V. Zahnd, Automating the detection of access control vulnerabilities in web applications. SN Comput. Sci. 3(5), 376 (2022)CrossRef M. Rennhard, M. Kushnir, O. Favre, D. Esposito, V. Zahnd, Automating the detection of access control vulnerabilities in web applications. SN Comput. Sci. 3(5), 376 (2022)CrossRef
Metadaten
Titel
An Investigation of Broken Access Control Types, Vulnerabilities, Protection, and Security
verfasst von
Elaf Almushiti
Raseel Zaki
Nora Thamer
Rima Alshaya
Copyright-Jahr
2024
DOI
https://doi.org/10.1007/978-3-031-53237-5_16

Premium Partner