Name Forceful Browsing
Summary An attacker employs forceful browsing to access portions of a website that are otherwise unreachable through direct URL entry. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.
Prerequisites The forcibly browseable pages or accessible resources must be discoverable and improperly protected.
Solutions Authenticate request to every resource. In addition, every page or resource must ensure that the request it is handling has been made in an authorized context. Forceful browsing can also be made difficult to a large extent by not hard-coding names of application pages or resources. This way, the attacker cannot figure out, from the application alone, the resources available from the present context.
Related Weaknesses
CWE ID Description
CWE-285 Improper Authorization
CWE-425 Direct Request ('Forced Browsing')
CWE-693 Protection Mechanism Failure
Back to Top