CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
Description
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
- Likelihood of attack
- High
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Prerequisites
- The target must apply access controls, but incorrectly configure them. However, not all incorrect configurations can be exploited by an attacker. If the incorrect configuration applies too little security to some functionality, then the attacker may be able to exploit it if the access control would be the only thing preventing an attacker's access and it no longer does so. If the incorrect configuration applies too much security, it must prevent legitimate activity and the attacker must be able...
Skills required
- LowIn order to discover unrestricted resources, the attacker does not need special tools or skills. They only have to observe the resources or access mechanisms invoked as each action is performed and then try and access those access mechanisms directly.
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- Authorization
Execute Unauthorized Commands
Run Arbitrary Code
- Authorization
Gain Privileges
- Access ControlAuthorization
Bypass Protection Mechanism
- Availability
Unreliable Execution
Mitigations
- Design: Configure the access control correctly.
Related weaknesses (CWE)
- CWE-732Incorrect Permission Assignment for Critical Resource
- CWE-1190DMA Device Enabled Too Early in Boot Phase
- CWE-1191On-Chip Debug and Test Interface With Improper Access Control
- CWE-1193Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
- CWE-1220Insufficient Granularity of Access Control
- CWE-1268Policy Privileges are not Assigned Consistently Between Control and Data Agents
- CWE-1280Access Control Check Implemented After Asset is Accessed
- CWE-1297Unprotected Confidential Information on Device is Accessible by OSAT Vendors
- CWE-1311Improper Translation of Security Attributes by Fabric Bridge
- CWE-1315Improper Setting of Bus Controlling Capability in Fabric End-point
- CWE-1318Missing Support for Security Features in On-chip Fabrics or Buses
- CWE-1320Improper Protection for Outbound Error Messages and Alert Signals
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SICASystem Init Config Analysis1 shared
- D3-SBVService Binary Verification1 shared
- D3-SFASystem File Analysis1 shared
- D3-AVEAsset Vulnerability Enumeration1 shared
- D3-RSRestore Software1 shared
- D3-SWISoftware Inventory1 shared
- D3-SUSoftware Update1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-CIConfiguration Inventory1 shared
- D3-RCRestore Configuration1 shared
- D3-EALExecutable Allowlisting1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 01 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-01-002Autorun Differences1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared
Related attack patterns
Parent
More specific patterns
- CAPEC-58Restful Privilege ElevationDetailed
- CAPEC-679Exploitation of Improperly Configured or Implemented Memory ProtectionsDetailed
- CAPEC-680Exploitation of Improperly Controlled RegistersDetailed
- CAPEC-681Exploitation of Improperly Controlled Hardware Security IdentifiersDetailed
- CAPEC-702Exploiting Incorrect Chaining or Granularity of Hardware Debug ComponentsDetailed