访问控制

谁能做什么。功能级权限缺失和权限提升在后台管理与多租户系统中最常见。

影响

以低权限账户执行管理员操作，或访问其他租户的资源

观察点

低权限账户成功调用了需要更高权限的接口

修复

采用默认拒绝的集中式授权，在每个接口上校验角色与租户，并为权限矩阵编写自动化测试。

弱点分布

• 访问控制缺陷（通用）772
• 权限提升455
• 授权不当55
• Unlabeled26
• 强制浏览14
• Incorrect Authorization13
• 违反安全设计原则（按标题归类）10
• Reliance on Cookies without Validation and Integrity Checking in a Security Decision8
• Reliance on Untrusted Inputs in a Security Decision8
• Improper Privilege Management7
• Missing Authorization7
• Improper Handling of Insufficient Permissions or Privileges4
• Execution with Unnecessary Privileges3
• Incorrect Permission Assignment for Critical Resource3
• Improper Export of Android Application Components2
• Incorrect Default Permissions2
• Incorrect Privilege Assignment2
• Reliance on Reverse DNS Resolution for a Security-Critical Action2
• Access Control Check Implemented After Asset is Accessed1
• Improper Preservation of Permissions1
• Origin Validation Error1

共现类别

暂无共现数据。

高票报告

当前状态 1,396 份 · 全部 1,396 · 筛选赏金 $493,784

1. 1,922
   Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · 2020-04-02 · 严重
   $0Unlabeled
2. 989
   Account Takeover via Password Reset without user interactionsGitLab · 2025-02-26 · 严重
   $35,000访问控制缺陷（通用）
3. 894
   [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · 2020-04-02 · 严重
   $0Unlabeled
4. 762
   Exfiltrate and mutate repository and project data through injected templated serviceGitLab · 2019-03-05 · 严重
   $11,000访问控制缺陷（通用）
5. 671
   Email address of any user can be queried on Report Invitation GraphQL type when username is knownHackerOne · 2020-02-21 · 高危
   $0授权不当
6. 638
   Getting all the CD keys of any gameValve · 2018-11-01 · 严重
   $20,000访问控制缺陷（通用）
7. 637
   Ability to reset password for accountUpserve · 2019-06-07 · 严重
   $0访问控制缺陷（通用）
8. 562
   Publicly accessible Continuous Integration ToolSnapchat · 2021-07-30 · 严重
   $0访问控制缺陷（通用）
9. 559
   Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationShopify · 2020-09-15 · 严重
   $0权限提升
10. 527
    Shopify Stocky App OAuth MisconfigurationShopify · 2019-12-11 · 中危
    $0权限提升
11. 509
    One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · 2022-08-02 · 严重
    $0访问控制缺陷（通用）
12. 493
    Able to Become Admin for Any LINE Official AccountLY Corporation · 2020-03-25 · 严重
    $0权限提升
13. 457
    Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsGitLab · 2019-11-27 · 严重
    $12,000权限提升
14. 440
    Reset password link sent over unsecured http protocolMattermost · 2023-05-10 · 高危
    $750访问控制缺陷（通用）
15. 412
    Full account takeoverReverb.com · 2020-03-19 · 高危
    $0访问控制缺陷（通用）
16. 398
    Read-only application can publish/delete fleetsX / xAI · 2021-01-05 · 中危
    $0权限提升
17. 374
    Cross-organization data access in city-mobil.ruMail.ru · — · 未评级
    $8,000访问控制缺陷（通用）
18. 371
    Multiple bugs leads to RCE on TikTok for AndroidTikTok · 2021-03-18 · 严重
    $0Improper Export of Android Application Components
19. 351
    Attacker is able to access commit title and team member comments which are supposed to be privateGitLab · 2019-07-04 · 高危
    $0访问控制缺陷（通用）
20. 346
    Private list members disclosure via GraphQLX / xAI · 2020-08-04 · 低危
    $0访问控制缺陷（通用）
21. 340
    [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious FileMail.ru · — · 未评级
    $0访问控制缺陷（通用）
22. 311
    [Razer Pay Mobile App] Broken access control allowing other user's bank account to be deletedRazer · — · 未评级
    $1,000授权不当
23. 311
    Subdomain takeover of datacafe-cert.starbucks.comStarbucks · 2019-08-29 · 高危
    $0权限提升
24. 311
    Shopify admin authentication bypass using partners.shopify.comShopify · 2017-09-29 · 严重
    $0授权不当
25. 306
    Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.comGitLab · 2019-04-19 · 严重
    $0Incorrect Authorization