Manage privilege modifications
Summary
The system must not allow system actors to modify privileges for themselves.
Description
Systems should have a set of roles with different levels of privilege to access resources. The privileges of each role must be clearly defined and the role of each user should also be clearly stated. Furthermore, users should not be allowed to modify their own privileges, as this could be leveraged to access otherwise restricted functionalities and resources.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- CAPECâ„¢-233. Privilege escalation
- CAPECâ„¢-690. Metadata Spoofing
- CWEâ„¢-267. Privilege defined with unsafe actions
- CWEâ„¢-269. Improper privilege management
- CWEâ„¢-639. Authorization bypass through user-controlled key
- OWASP TOP 10-A1. Broken access control
- OWASP-M TOP 10-M6. Insecure authorization
- BIZEC-APP-APP-06. Direct database modifications
- MITRE ATT&CK®-M1024. Restrict registry permissions
- MITRE ATT&CK®-M1026. Privileged account management
- MITRE ATT&CK®-M1039. Environment variable permissions
- MITRE ATT&CK®-M1052. User account control
- MITRE ATT&CK®-M1056. Pre-compromise
- PA-DSS-3_4. Limit access to required functions/resources and enforce least privilege for built-in accounts
- PA-DSS-5_2_8. Improper access controls
- SANS 25-11. Missing authorization
- CMMC-AC_L1-3_1_1. Authorized access control
- CMMC-AC_L2-3_1_4. Separation of duties
- CMMC-AC_L2-3_1_7. Privileged functions
- HITRUST CSF-01_c. Privilege management
- FedRAMP-AC-6_1. Least privilege - Authorize access to security functions
- FedRAMP-CM-5_5. Access restrictions for change - Limit production, operational privileges
- ISO/IEC 27002-8_2. Privileged access rights
- OSSTMM3-9_15_3. Wireless security (privileges audit) - Escalation
- WASC-A_12. Content spoofing
- WASC-W_02. Insufficient authorization
- ISSAF-A_2_4. Assessment - Penetration
- ISSAF-P_6_15. Host security - Linux security (local attacks)
- ISSAF-Q_16_20. Host security - Windows security (local attacks)
- ISSAF-Y_3_4. Database Security - Database services countermeasures
- OWASP Top 10 Privacy Risks-P2. Operator-sided data leakage
- BSAFSS-AA_1-2. Authorization and access controls
- BSAFSS-AA_2-1. Authorization and access (support controls)
- CWE TOP 25-862. Missing authorization
- SWIFT CSCF-5_1. Logical access control
- C2M2-9_5_h. Implement data security for cybersecurity architecture
- PCI DSS-7_2_3. Required privileges are approved by authorized personnel
- OWASP API Security Top 10-API1. Broken Object Level Authorization
- ISO/IEC 27001-8_2. Privileged access rights
- NIST CSF-PR_AA-01. Identities and credentials for authorized users, services, and hardware are managed by the organization
Vulnerabilities
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.