Identity Management / Role Manipulation
Role manipulation is a type of vulnerability in the identity management domain, applicable to web and API infrastructure, which is described in the CWE Directory as “an attacker manipulating user roles or privileges”. This type of attack occurs when attackers gain access to a user account with greater privileges than their own, and then use the additional privileges to gain access to confidential data, modify account settings, or otherwise manipulate the system. The OWASP Testing Guide provides details on how to test for this type of vulnerability.
Role manipulation is particularly dangerous because it can allow attackers to gain wider access to a system, and can often be used to manipulate data and settings in a system, making it vulnerable to further attacks. Without proper role management, attackers can gain access to sensitive data, or even take control of the system, with catastrophic outcomes.
To protect against role manipulation attacks, organizations should use secure authentication and authorization protocols to ensure appropriate user access. Additionally, role management systems should be in place to make sure that users can only access the resources and data appropriate to their roles. Organizations should also monitor user access logs to detect any suspicious activity.
The following example code is an example of a role manipulation vulnerability from the CVE directory (CVE-2020-8556).
def update_user user = User.find(params[:id]) user.admin = true user.save end
This code allows users to be updated to have admin privileges, even if the current user does not have the authorization to do so.