Elevating User Privilege

Introduction

Welcome to the fourth lesson of the "Broken Access Control" course! In this lesson, we will explore the concept of privilege escalation, a critical aspect of broken access control vulnerabilities. By understanding how attackers can exploit these vulnerabilities to gain unauthorized access to higher-level privileges, you'll be better equipped to secure your applications. Let's dive in and learn how to prevent privilege escalation! 🚀

Understanding Privilege Escalation

Privilege escalation occurs when an attacker gains elevated access to resources that are normally protected from an application or user. There are two main types: vertical and horizontal privilege escalation. Vertical privilege escalation involves gaining higher-level privileges, such as administrative rights, while horizontal privilege escalation involves accessing resources of another user with similar privileges. For example, if a regular user can change their role to an admin by manipulating a request, that's vertical privilege escalation. On the other hand, if a user can view another user's private data without permission, that's horizontal privilege escalation. Understanding these concepts is vital for securing web applications against unauthorized access. Let's look at a vulnerable code example to see how these vulnerabilities can manifest in real applications.

Vulnerable Code Example

Let's examine a code snippet that demonstrates a vulnerability allowing privilege escalation. This example shows how a lack of proper validation can lead to unauthorized role changes. TypeScript router.put('/:id', async (req, res) => {const user = await User.findByPk(req.params.id); if (!user) {return res.status(404).send('User not found');} await user.update(req.body); res.json(user);}); router.put('/:id', async (req, res) => {const user = await User.findByPk(req.params.id); if (!user) {return res.status(404).send('User not found');} await user.update(req.body); res.json(user);}); In this code, any user can update their profile, including the role field, without any checks. An attacker could send a payload to change their role to admin, leading to privilege escalation. This vulnerability arises from the absence of field filtering and role validation. To understand the severity of this issue, let's see how an attacker might exploit this vulnerability.

Exploiting the Vulnerability

To understand the impact of the vulnerability, let's see how it can be exploited. An attacker could use a simple script to change their role to admin . Shell curl -X PUT -H "Content-Type: application/json" -d '{"role": "admin", "username": "attacker", "password": "newpassword"}' http://localhost:3000/api/user/1 This command sends a request to update the user's role to admin . Without proper validation, the application accepts this change, granting the attacker unauthorized admin access. This highlights the importance of securing code against such exploits. Let's start fixing these vulnerabilities by implementing proper authentication middleware.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

JWT Authentication

Since we're using JWT authentication, as a first step, we can eliminate the need for ID parameters in our routes and instead utilize the user information stored in the token. Let's first look at our authentication middleware that we used before:

TypeScript

export const authenticateToken = (req: Request, res: Response, next: NextFunction) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: "Authentication required" });
  }

  try {
    const decoded = jwt.verify(token, JWT_SECRET_KEY) as { userId: number };
    req.user = { id: decoded.userId };
    next();
  } catch (err) {
    return res.status(403).json({ error: "Invalid token" });
  }
};

export const authenticateToken = (req: Request, res: Response, next: NextFunction) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: "Authentication required" });
  }

  try {
    const decoded = jwt.verify(token, JWT_SECRET_KEY) as { userId: number };
    req.user = { id: decoded.userId };
    next();
  } catch (err) {
    return res.status(403).json({ error: "Invalid token" });
  }
};

We apply this middleware to protect all user routes like so:

TypeScript

router.use('/api/user', authenticateToken, userRoutes);

router.use('/api/user', authenticateToken, userRoutes);

This line ensures that any request to the /api/user endpoint must be authenticated, allowing us to securely access user information and perform operations based on the authenticated user's identity.

Now we can update our profile endpoint to use the authenticated user's information:

TypeScript

router.put('/profile', async (req, res) => {
  const user = await User.findByPk(req.user.id);
  if (!user) {
    return res.status(404).send('User not found');
  }
  await user.update(req.body);
  res.json(user);
});

router.put('/profile', async (req, res) => {
  const user = await User.findByPk(req.user.id);
  if (!user) {
    return res.status(404).send('User not found');
  }
  await user.update(req.body);
  res.json(user);
});

The authenticateToken middleware verifies the JWT token and makes the user's information available through req.user, providing a secure way to identify the requesting user without relying on URL parameters.

Now that we have proper authentication in place, let's implement identity verification for our user updates.

Introduction

Understanding Privilege Escalation

Vulnerable Code Example

Exploiting the Vulnerability

Join the 1M+ learners on CodeSignal

JWT Authentication

Authentication and Identity Verification

Restricting Field Updates

Allowing Admin Updates

Conclusion and Next Steps