Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some resource.
1 Answer
Potentially, sure.
If permissions are viewable, that gives an attacker a list of valid usernames and tells the attacker which accounts are the best candidates to attack. An attacker is much more likely to want to break in to the jdoe account in the HR system if they know, for example, that jdoe has the ability to see everyone's salary.
Making permissions viewable also makes it much more likely that other security shortcomings are going to be exploited. If someone forgot to remove the jdoe account when he was fired, for example, or if someone inadvertently assigned privileges to jdoe rather than janedoe, viewable privileges lets the attacker see immediately where the weak points are and figure out how to craft an attack to stop it.
Of course, the attacker still has to craft an appropriate attack-- whether technical or social-- to exploit the information they get from being able to view other users' privileges. It just makes it quicker, easier, and safer to mount the attack if you know where the pressure points are.
answered Jun 19, 2012 at 22:33
