Skip to main content
Information Security

Return to Question

Tweeted twitter.com/#!/StackSecurity/status/598069366714925057
added 40 characters in body
Source Link
magneto
magneto
  • 31
  • 3

I'm testing a website to find out vulnerabilities. Website is fully running on HTTPS only.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013:

  • What kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"?
  • Does this vulnerability has any particular name?
  • What would be the severity and impact?

Please explain it in-depth.

I'm testing a website to find out vulnerabilities.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013:

  • What kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"?
  • Does this vulnerability has any particular name?
  • What would be the severity and impact?

Please explain it in-depth.

I'm testing a website to find out vulnerabilities. Website is fully running on HTTPS only.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013:

  • What kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"?
  • Does this vulnerability has any particular name?
  • What would be the severity and impact?

Please explain it in-depth.

added 82 characters in body
Source Link
WhiteWinterWolf
WhiteWinterWolf
  • 19.4k
  • 4
  • 62
  • 112

I'm testing a website to find out vulnerabilities.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013, what kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"? Does this vulnerability has any particular name? What would be the severity and impact?OWASP Top 10 - 2013:

  • What kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"?
  • Does this vulnerability has any particular name?
  • What would be the severity and impact?

Please explain it in-depth.

I'm testing a website to find out vulnerabilities.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013, what kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"? Does this vulnerability has any particular name? What would be the severity and impact? Please explain it in-depth.

I'm testing a website to find out vulnerabilities.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013:

  • What kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"?
  • Does this vulnerability has any particular name?
  • What would be the severity and impact?

Please explain it in-depth.

Source Link
magneto
magneto
  • 31
  • 3

web security testing - vulnerability issue

I'm testing a website to find out vulnerabilities.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013, what kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"? Does this vulnerability has any particular name? What would be the severity and impact? Please explain it in-depth.