Security Test: Private data¶

Description¶

Default Severity: high

The issue is that data meant to be private isn’t properly locked down, so even users who shouldn't see it can access it. This happens when configuration rules or access controls are misconfigured or applied incorrectly, allowing sensitive data to leak out. It's dangerous because attackers or anyone who stumbles upon the vulnerability can retrieve data they aren’t supposed to, which might lead to privacy breaches, identity theft, or other serious security problems. Developers often fall into the trap of relying solely on configuration files for security without additional safeguards or thorough testing, leaving private data exposed if those rules are flawed.

Reference:

• https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html

Configuration¶

Identifier: access_control/private_data

Examples¶

All configuration available:

checks:
  access_control/private_data:
    skip: false # default
    parameters:
      __user: # cf. Parameters below
      rules: # cf. Parameters below

REST: Ensure user some-user retrieve an admin user on a list of users at GET /users

checks:
  AccessControl_PrivateData:
    parameters:
      rules:
        - user: some-user
          routes:
            - method: GET
              path: /users
              pattern: ".*admin: true.*"

REST: Ensure user some-user cannot access the fields email with value @mycompany.com and role.group with value admin on route GET /users

checks:
  AccessControl_PrivateData:
    parameters:
      rules:
        - user: some-user
          routes:
            - method: GET
              path: /users
              fields: ["email"]
              pattern: "@mycompany.com"
            - method: GET
              path: /users
              fields: ["role.group"]
              pattern: "admin"

REST: Ensure user some-user cannot access a field admin-* on route GET /admin

checks:
  AccessControl_PrivateData:
    parameters:
      rules:
        - user: some-user
          routes:
            - method: GET
              path: /admin
              fields: ["admin-*"]
              pattern: ".*"

Parameters¶

Parameters can be set in the parameters key of the Security Test Configuration.

ObjectRefItems3¶

ObjectRefRules2¶

ObjectRefUser1¶

EnumRefMethod4¶

Compliance and Standards¶