Evasión del control de acceso
Una vulnerabilidad que permite a un atacante acceder a recursos protegidos eludiendo los mecanismos de autorización del sistema.
Vulnerabilidad clasificada bajo CWE-284, #1 en OWASP Top 10 2021. Causas: ausencia de comprobaciones de autorización a nivel de función, uso de datos del cliente para decisiones de autorización, comprobaciones insuficientes a nivel de objeto (IDOR).
graph LR
Center["Evasión del control de acceso"]:::main
Pre_authentication["authentication"]:::pre --> Center
click Pre_authentication "/terms/authentication"
Rel_zero_trust_security["zero-trust-security"]:::related -.-> Center
click Rel_zero_trust_security "/terms/zero-trust-security"
classDef main fill:#7c3aed,stroke:#8b5cf6,stroke-width:2px,color:white,font-weight:bold,rx:5,ry:5;
classDef pre fill:#0f172a,stroke:#3b82f6,color:#94a3b8,rx:5,ry:5;
classDef child fill:#0f172a,stroke:#10b981,color:#94a3b8,rx:5,ry:5;
classDef related fill:#0f172a,stroke:#8b5cf6,stroke-dasharray: 5 5,color:#94a3b8,rx:5,ry:5;
linkStyle default stroke:#4b5563,stroke-width:2px;
🧒 Explícalo como si tuviera 5 años
Imagina una biblioteca donde necesitas una tarjeta especial para entrar a la sala de 'solo personal'. La evasión del control de acceso es como encontrar una ventana sin cerrar, o un truco para que el guardia te deje pasar sin revisar tu tarjeta.
🤓 Expert Deep Dive
Tipos de ataque: IDOR, traversal de rutas, escalada de privilegios vertical, asignación masiva, navegación forzada. Clasificado bajo CWE-284. Modelos: DAC, MAC, RBAC, ABAC. Mitigación: denegar por defecto, verificación en el servidor en cada solicitud.
❓ Preguntas frecuentes
What is the difference between access control bypass and authentication bypass?
Authentication bypass defeats identity verification (you appear as someone you're not). Access control bypass assumes you may be legitimately authenticated but exploits flaws in permission enforcement — you access resources your account is not authorized to use.
Why is broken access control ranked #1 in OWASP Top 10 2021?
It was found in 94% of applications tested during the OWASP data collection period, with 318,000+ CVEs mapping to this category. It moved from #5 (2017) to #1 (2021) due to its prevalence in modern API-driven architectures where authorization checks are frequently incomplete.
How do I test for IDOR vulnerabilities?
Create two test accounts. Perform actions as Account A and capture the resource IDs (invoice IDs, user IDs, document IDs) in the request. Then replay those requests authenticated as Account B. If Account B can access Account A's resources, IDOR exists.