Abhishek M (Community Member) asked a question.

October 28, 2024 at 7:19 AM
Hi Team,

We have a query regarding Authorization Bypass Through User-Controlled SQL Primary Key (CWE ID 566). We are getting this flaw at the DAO layer.

Hi Team,

 

We have a query regarding Authorization Bypass Through User-Controlled SQL Primary Key (CWE ID 566). We are getting this flaw at the DAO layer. So we wanted to check if we can utilize the session parameter which we are retrieving from the HttpServletRequest object at the controller layer for authorizing the user at the dao layer?

 

 

 

  • 4 answers
  • 1.28K views

  • SamHouston (Veracode)

    Hi Abhishek!

     

    If you're conducting an authorization check to ensure the user has access to perform the action and view the associated records, that should help reduce the risk. It’s likely that any implementation will still flag as a potential issue, so you’ll probably need to document a mitigation strategy. If you have further questions or need more tailored guidance, consider scheduling a consultation call to go over specific examples and discuss your implementation in detail.

     

    https://docs.veracode.com/r/t_schedule_consultation

    Expand Post
    Selected as Best

  • SamHouston (Veracode)

    Hi Abhishek!

     

    If you're conducting an authorization check to ensure the user has access to perform the action and view the associated records, that should help reduce the risk. It’s likely that any implementation will still flag as a potential issue, so you’ll probably need to document a mitigation strategy. If you have further questions or need more tailored guidance, consider scheduling a consultation call to go over specific examples and discuss your implementation in detail.

     

    https://docs.veracode.com/r/t_schedule_consultation

    Expand Post
    Selected as Best

    • Abhishek M (Community Member)

      do we have any specific type of fix recommended by Veracode to close the issue reported in this scenario, we now are planning to conduct authorization check to ensure the user has access to perform the action and view the associated records, but as said it might not make the flaw cleared, do we have any particular implementation suggested? or will this check be enough?

      • SamHouston (Veracode)

        The check is our suggested workaround for now - I'm unfortunately unable to speak to a more specific solution, but if you schedule a consultation our team will be able to help you 🙂

         

        Have a great day!

        -Sam

        Expand Post

Topics (7)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.