Admin Functionality visible to basic users

Question

An application's interface is same for every type of user role. The access-matrix is also well maintained. However, the names of almost all functionalities are visible to all the users. But if the user is not authorized to a particular action, it says "Unauthorized" and then redirects the user to home page.

I am not sure should I report this one to the app owners? If I do, does it fall in the category of 'best practice' or a 'vulnerability'? Please advise.

Answer 1

If it is a client-server application then maybe it is worth having a look at whether it is only the client that says "unauthorized" or whether a request is sent to the server and the server gives that reply. I bet there are many poorly written software systems whose developers think the job is done when they reject a specific action on the client without securing the server's interfaces.

Answer 2

The security should not rely on the IHM. So as you say that when an unauthorized user asks for an administrative action, the action is refused, there is no vulnerability here. One could argue that it is better to hide the administrative URL to normal users because it could help an attacker to discover vulnerabilities, but it sounds like security by obfuscation. The security part says:

• reject mal-formed queries before they are processed by the business layer
• reject unauthorized user actions

That being said, it leads to a very poor user experience, because the average (non admin) user sees options that he is not allowed to use. So my opinion is that you really should report to the app owners, but in the category user experience - definitely more best practice than vulnerability

Answer 3

This is what I would do in such a case:

1. Verify if the redirect is a client side control.
2. Verify if I can escalate my privilege to that of a higher privileged user using the parameters of that user. For example, if useradd is only there for admin I would login with normal user and attempt that request in the proxy manipulating everything except the session cookie.

If neither works, i would report it as a suggested best practice. I would emphasize in the report that if in future, any additional module is added and the current session/access controls are missing in those modules, a low privileged user may be easily able to identify and manipulate the new feature.