3

I'm testing a website to find out vulnerabilities. Website is fully running on HTTPS only.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013:

  • What kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"?
  • Does this vulnerability has any particular name?
  • What would be the severity and impact?

Please explain it in-depth.

Improve this question
4
  • I don't think that's a vulnerability or a security issue. Did you setup your web server correctly???
    – balex
    Commented May 11, 2015 at 12:22
  • How is this not a vulnerability? If one can access confidential files by directly accessing the url/page without any privileges, it's a major issue/vulnerability. I'm not a developer. I'm just testing a website for vulnerability assessment.
    – magneto
    Commented May 11, 2015 at 12:32
  • If I understand correctly, the webserver wasn't setup correctly. It's restricting the access successfully on https but not in http probably because of bad config. You can call it vulnerability, surely (my mistake). To answer your question - which I forgot (apologize me). It's A4.
    – balex
    Commented May 11, 2015 at 12:39
  • 1
    The description clearly shows a vulnerability and security issue. Such issues do not limit themselves to getting a root shell on the exploited server, depending on the concerned data allowing unauthorized access to sensitive data may have major business consequences. And yes, this vulnerability is most probably caused by a server / web application misconfiguration to be reported.
    – WhiteWinterWolf
    Commented May 11, 2015 at 12:39

2 Answers 2

Reset to default
1

The web server seems to apply different security control whether the access comes from HTTPS and from HTTP.

Most probable is that the designers thought that this file would be accessible only to HTTPS users, and missed the fact that this URL can also be served through HTTP.

In your question you refer to:

  • A7 – Missing Function Level Access Control: This flaw is about a mismatch between the options proposed in the web interface and the options actually accepted on the web server side, the error being to disable an option only on the interface without disabling its use on the server side. Here there no mention of web interface, and allowed user should use HTTPS link anyway, so this is not the correct topic to classify the current issue.
  • A4 – Insecure Direct Object References: This flaw seems to address merely internal objects access, ie. objects which should not be accessed at all. However, one may argue that this file should indeed not be accessed at all through HTTP, so from this point of view it might be a correct topic.

Otherwise, "A5 - Security Misconfiguration" may also match since this is just a setting issue, either an HTTPS file access setting wrongly affecting HTTP accesses, or a missing restriction on HTTP file accesses.

Regarding the technical impact, it gives unauthorized people access to this file. The business impact directly depends on the file's content.

Improve this answer
2
  • thanks for explanation. But what name should I give to this vulnerability? How should I explain this to web-developer? Any description about this kind of vulnerability and any mitigation steps? or should I write it on my own?
    – magneto
    Commented May 11, 2015 at 12:41
  • Either you have access to the server configuration or website code, then you are on your own to dig and provide more advanced information to the developers, or you do not have such access then a description similar to your question showing the expected behavior, how it can be circumvented and the potential business impacts will do it (up to the developers or the web admin to provide a fix). Choosing between A4 and A5 will mainly depend on the context, but A4 may bear a more precise and suitable name.
    – WhiteWinterWolf
    Commented May 11, 2015 at 12:50
1

You haven't mentioned whether you have tried the request with cookies (or other authentication data) withheld.

If the request still works without authentication for the same scheme and you've removed caching headers like If-Modified-Since and If-None-Match then it is "A4 – Insecure Direct Object References". If the request works only when you haven't altered the request to disable cached responses then this is "A5-Security Misconfiguration" because the application is caching private content.

If the request works with cookies on both HTTP and HTTPS, then this is also "A5-Security Misconfiguration". This is because the application should be setting the Secure Flag on cookies or ideally implementing HSTS to prevent authentication cookies from being sent over an insecure connection.

Improve this answer
4
  • I have accessed that HTTP request without any authentication. When I intercepted that request, this is the response header I received: HTTP/1.1 200 OK Date: Tue, 12 May 2015 17:29:20 GMT Server: Apache Last-Modified: Fri, 05 Dec 2014 04:13:15 GMT Etag: "de4349-11aa5-509704bb9acc0" Accept-Ranges: bytes Content-Length: 72357 Cache-Control: max-age=31536000 Expires: Wed, 11 May 2016 17:29:20 GMT Connection: keep-alive, close Content-Type: image/jpeg
    – magneto
    Commented May 12, 2015 at 17:30
  • @magneto: Therefore this is "A4 – Insecure Direct Object References" - is this for a different file as I noticed the content type says jpeg.?
    – SilverlightFox
    Commented May 12, 2015 at 17:36
  • ok. And yeah, this request is for image file. You won't believe but this website has all the confidential contents available after converting it from HTTPS to HTTP! I'm wondering what name should I give to this vulnerability? I put severity as High and it has severe business impact also. Any additional suggestion from you regarding this vuln.?
    – magneto
    Commented May 12, 2015 at 17:46
  • @magneto: Probably both A4 and A5 as it appears to be a config issue also.
    – SilverlightFox
    Commented May 12, 2015 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .