CAPEC-58: Restful Privilege Elevation

MITRE CAPEC attack pattern

Description

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-267, CWE-269

Prerequisites

• The attacker needs to be able to identify HTTP Get URLs. The Get methods must be set to call applications that perform operations other than get such as update and delete.

Skills required

• Low: It is relatively straightforward to identify an HTTP Get method that changes state on the server side and executes against an over-privileged system interface

Consequences

• Integrity: Modify Data
• Confidentiality, Access Control, Authorization: Gain Privileges

Mitigations

• Design: Enforce principle of least privilege
• Implementation: Ensure that HTTP Get methods only retrieve state and do not alter state on the server side
• Implementation: Ensure that HTTP methods have proper ACLs based on what the functionality they expose

Source

• MITRE CAPEC CAPEC-58