Access Control Vulnerabilities

// Güvensiz kod örneği - URL tabanlı erişim kontrolü
// admin.php
if ($_GET['role'] == 'admin') {
    // Admin paneli göster
    showAdminPanel();
}

// Saldırı: http://example.com/admin.php?role=admin
// Sonuç: Herkes admin paneline erişebilir!

// Vulnerable endpoint
GET /api/user/profile?id=1234
Authorization: Bearer user_a_token

// Saldırı - ID değiştirme
GET /api/user/profile?id=5678
Authorization: Bearer user_a_token

// Sonuç: Kullanıcı A, kullanıcı B'nin profilini görebilir

// Cookie manipulation örneği
// Normal kullanıcı cookie'si
Set-Cookie: user_role=user; user_id=123

// Manipüle edilmiş cookie
Set-Cookie: user_role=admin; user_id=123

// HTTP Header manipulation
X-User-Role: admin
X-User-Privileges: all
X-Admin-Access: true

// Vulnerable code - Direct file access
public function downloadFile($fileId) {
    $file = "uploads/" . $fileId . ".pdf";
    if (file_exists($file)) {
        readfile($file); // Yetkilendirme kontrolü yok!
    }
}

// Secure implementation
public function downloadFile($fileId, $userId) {
    $file = FileModel::where('id', $fileId)
                   ->where('owner_id', $userId)
                   ->first();
    if ($file && $this->userCanAccess($file)) {
        readfile($file->path);
    }
}

// Vulnerable API endpoint
app.delete('/api/users/:id', (req, res) => {
    // Yetkilendirme kontrolü yok!
    User.deleteOne({_id: req.params.id});
    res.json({success: true});
});

// Secure implementation
app.delete('/api/users/:id', authenticateToken, requireAdmin, (req, res) => {
    if (req.user.role !== 'admin') {
        return res.status(403).json({error: 'Forbidden'});
    }
    User.deleteOne({_id: req.params.id});
    res.json({success: true});
});

// HTTP Method Override Bypass
POST /api/users/123 HTTP/1.1
X-HTTP-Method-Override: DELETE
Content-Type: application/json

{"action": "delete"}

// Header-based Bypass
GET /admin/panel HTTP/1.1
X-Original-URL: /admin/panel
X-Forwarded-Host: internal.admin.com
X-Custom-IP-Authorization: 127.0.0.1

// Parameter Pollution
GET /transfer?from=1234&to=5678&amount=100&to=attacker_account

// RBAC Implementation Example
class RoleBasedAuth {
    private $roles = [
        'admin' => ['read', 'write', 'delete', 'manage_users'],
        'editor' => ['read', 'write'],
        'viewer' => ['read']
    ];
    
    public function hasPermission($userRole, $permission) {
        return in_array($permission, $this->roles[$userRole] ?? []);
    }
}

// ABAC Implementation Example  
class AttributeBasedAuth {
    public function canAccess($user, $resource, $action, $environment) {
        $policy = [
            'user' => ['department' => $user->department, 'level' => $user->level],
            'resource' => ['type' => $resource->type, 'classification' => $resource->classification],
            'environment' => ['time' => date('H'), 'location' => $environment->location]
        ];
        
        return $this->evaluatePolicy($policy, $action);
    }
}

// RBAC Database Schema Example
CREATE TABLE users (
    id INT PRIMARY KEY,
    username VARCHAR(50),
    email VARCHAR(100)
);

CREATE TABLE roles (
    id INT PRIMARY KEY,
    name VARCHAR(50),
    description TEXT
);

CREATE TABLE permissions (
    id INT PRIMARY KEY,
    resource VARCHAR(50),
    action VARCHAR(50) -- CREATE, READ, UPDATE, DELETE
);

CREATE TABLE user_roles (
    user_id INT,
    role_id INT,
    granted_at TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id),
    FOREIGN KEY (role_id) REFERENCES roles(id)
);

CREATE TABLE role_permissions (
    role_id INT,
    permission_id INT,
    FOREIGN KEY (role_id) REFERENCES roles(id),
    FOREIGN KEY (permission_id) REFERENCES permissions(id)
);

// ABAC Policy Example (XACML-like)
{
  "policy": {
    "target": {
      "subject": {"department": "Finance"},
      "resource": {"classification": "Confidential"},
      "action": {"operation": "read"}
    },
    "condition": {
      "and": [
        {"time": {"between": ["09:00", "17:00"]}},
        {"location": {"in": ["office", "vpn"]}},
        {"device": {"trusted": true}}
      ]
    },
    "effect": "Permit"
  }
}

// ABAC Implementation
function evaluateAccess(subject, resource, action, environment) {
    const policies = loadPolicies();
    
    for (const policy of policies) {
        if (matchesTarget(policy.target, subject, resource, action) &&
            evaluateConditions(policy.condition, environment)) {
            return policy.effect;
        }
    }
    
    return "Deny"; // Default deny
}

// Access Control Test Suite Example
class AccessControlTester {
    
    async testHorizontalEscalation(userA, userB) {
        // Test if userA can access userB's resources
        const userASession = await login(userA);
        const userBResources = await getResourceList(userB);
        
        for (const resource of userBResources) {
            const response = await accessResource(resource.id, userASession);
            if (response.status === 200) {
                reportVulnerability(`Horizontal escalation: User ${userA.id} accessed ${resource.id}`);
            }
        }
    }
    
    async testVerticalEscalation(lowPrivUser, highPrivUser) {
        const lowSession = await login(lowPrivUser);
        const adminEndpoints = await getAdminEndpoints();
        
        for (const endpoint of adminEndpoints) {
            const response = await makeRequest(endpoint, lowSession);
            if (response.status !== 403) {
                reportVulnerability(`Vertical escalation: Low priv user accessed ${endpoint}`);
            }
        }
    }
    
    async testParameterManipulation(user, resourceId) {
        const session = await login(user);
        const testParams = generateParameterVariations(resourceId);
        
        for (const param of testParams) {
            const response = await accessResource(param, session);
            analyzeResponse(response, param);
        }
    }
}

#!/bin/bash
# Automated Access Control Testing Script

# Test different user roles
USERS=("admin:admin123" "user:user123" "guest:guest123")
ENDPOINTS=("/api/users" "/api/admin" "/api/reports" "/api/settings")

for user in "${USERS[@]}"; do
    IFS=':' read -ra CREDENTIALS <<< "$user"
    USERNAME=${CREDENTIALS[0]}
    PASSWORD=${CREDENTIALS[1]}
    
    # Login and get session token
    TOKEN=$(curl -s -X POST "http://target.com/login" \
        -d "username=$USERNAME&password=$PASSWORD" | \
        grep -o '"token":"[^"]*' | cut -d'"' -f4)
    
    echo "Testing with user: $USERNAME"
    
    for endpoint in "${ENDPOINTS[@]}"; do
        RESPONSE=$(curl -s -w "%{http_code}" -o /dev/null \
            -H "Authorization: Bearer $TOKEN" \
            "http://target.com$endpoint")
        
        echo "$USERNAME -> $endpoint: HTTP $RESPONSE"
        
        if [ "$RESPONSE" = "200" ] && [ "$USERNAME" != "admin" ] && [[ "$endpoint" == *"admin"* ]]; then
            echo "⚠️  POTENTIAL VULNERABILITY: $USERNAME accessed admin endpoint"
        fi
    done
    echo "---"
done

// Manual Testing Checklist - Web Application

1. Authentication Testing:
   □ Brute force protection
   □ Account lockout mechanism
   □ Password reset functionality
   □ Remember me functionality
   □ Multi-factor authentication bypass

2. Session Management:
   □ Session timeout enforcement
   □ Session fixation attacks
   □ Concurrent session handling
   □ Session token entropy
   □ Secure cookie attributes

3. Authorization Testing:
   □ Direct object reference
   □ Function level access control
   □ Data level access control
   □ Privilege escalation (horizontal/vertical)
   □ Missing authorization

4. Business Logic:
   □ Workflow bypass
   □ Race conditions
   □ Parameter manipulation
   □ State manipulation
   □ Process timing attacks

// Secure Access Control Implementation

// 1. Server-side Authorization Middleware
function requireAuth(role = null) {
    return (req, res, next) => {
        const token = req.headers.authorization?.split(' ')[1];
        
        if (!token) {
            return res.status(401).json({ error: 'Authentication required' });
        }
        
        const user = verifyToken(token);
        if (!user) {
            return res.status(401).json({ error: 'Invalid token' });
        }
        
        if (role && !user.roles.includes(role)) {
            return res.status(403).json({ error: 'Insufficient privileges' });
        }
        
        req.user = user;
        next();
    };
}

// 2. Resource-based Authorization
function canAccessResource(userId, resourceId, action) {
    const resource = getResource(resourceId);
    const user = getUser(userId);
    
    // Owner can do everything
    if (resource.ownerId === userId) {
        return true;
    }
    
    // Check role-based permissions
    const permission = `${resource.type}:${action}`;
    return user.permissions.includes(permission);
}

// 3. Usage in routes
app.get('/api/documents/:id', requireAuth(), (req, res) => {
    const documentId = req.params.id;
    
    if (!canAccessResource(req.user.id, documentId, 'read')) {
        return res.status(403).json({ error: 'Access denied' });
    }
    
    const document = getDocument(documentId);
    res.json(document);
});

// Security Headers Implementation
app.use((req, res, next) => {
    // Security headers
    res.setHeader('X-Content-Type-Options', 'nosniff');
    res.setHeader('X-Frame-Options', 'DENY');
    res.setHeader('X-XSS-Protection', '1; mode=block');
    res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
    
    // CORS configuration
    res.setHeader('Access-Control-Allow-Origin', 'https://trusted-domain.com');
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    
    next();
});

// Rate limiting per user role
const rateLimitConfig = {
    'guest': { max: 10, windowMs: 15 * 60 * 1000 }, // 10 requests per 15 minutes
    'user': { max: 100, windowMs: 15 * 60 * 1000 }, // 100 requests per 15 minutes
    'admin': { max: 1000, windowMs: 15 * 60 * 1000 } // 1000 requests per 15 minutes
};

// Input validation and sanitization
function validateAndSanitize(req, res, next) {
    const allowedFields = ['name', 'email', 'department'];
    const sanitizedBody = {};
    
    for (const field of allowedFields) {
        if (req.body[field]) {
            sanitizedBody[field] = validator.escape(req.body[field]);
        }
    }
    
    req.body = sanitizedBody;
    next();
}

// Vulnerable Code from Real Breach
// This code was found in a major e-commerce breach
function getOrder($orderId) {
    // No user ownership validation!
    $query = "SELECT * FROM orders WHERE id = " . $orderId;
    return mysqli_query($connection, $query);
}

// Secure Implementation
function getOrder($orderId, $userId) {
    $stmt = $pdo->prepare("SELECT * FROM orders WHERE id = ? AND user_id = ?");
    $stmt->execute([$orderId, $userId]);
    return $stmt->fetch();
    
    // Additional logging for security monitoring
    logAccess($userId, 'order_access', $orderId, 
        $stmt->rowCount() > 0 ? 'success' : 'denied');
}