CWE-284: Improper Access Control

Description:
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Extended Description:
Access control involves the use of several protection mechanisms such as: 
             
                Authentication (proving the identity of an actor) 
                Authorization (ensuring that a given actor can access a resource), and 
                Accountability (tracking of activities that were performed) 
             
             When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. 
             There are two distinct behaviors that can introduce access control weaknesses: 
                
                   Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator. 
      

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, ICS/OT, Web Based

Consequences:
  - Other: Varies by Context

Mitigations:
  - [Architecture and Design] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  - [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 
                   Ensure that appropriate compartm

Demonstrative examples:
This code temporarily raises the program's privileges to allow creation of a new user folder.
While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.
def makeNewUserDir(username): 
                         if invalidUsername(username): 
                               
                                  
                                  #avoid CWE-22 and CWE-78 
                                  print('Usernames cannot contain invalid characters') return False 
                            
                            try: rai

This function runs an arbitrary SQL query on a given database, returning the result of the query.
While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); 
                         //Use a prepared statement to avoid CWE-89 
                         $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } 
                      /.../ 
                      
                      $

Real-world examples:
  - CVE-2023-26463: Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)
  - CVE-2022-24985: A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms
  - CVE-2022-29238: Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in thos
  - CVE-2022-23607: Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect
  - CVE-2021-21972: Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpecte