Forum Discussion

pcastagnaro_709's avatar
pcastagnaro_709
Icon for Nimbostratus rankNimbostratus
Mar 12, 2013

Parameter Tampering

Dear all,

 

 

I want to know how can I avoid users to manipulate the URL and circumvent a security permission?

 

 

Example, user clicks a link: http://myweb.com/student_data/academic_data.jsp?studentID=AAA12345

 

 

In this example the parameter will be for user ID XXX12345, but what if the end user manipulates the URL and place studentID=CCC56789 (someone else)?

 

 

I tried adding parameter studentID as a global parameter, but it did not solve my issue.

 

 

This web server is on a productive environment, and my client does not want to invest in a programmer to code a new application in order to solve this problem.

 

 

I hope somebody can help me.

 

 

Thanks in advance!

 

APM
app sec
security

7 Replies

Sort By
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Mar 12, 2013
    Dependant on the answer to Mike's question could a flow policy work for you?

     

     

    Rgds

     

    N
  • pcastagnaro_709's avatar
    pcastagnaro_709
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2013
    Posted By Mike Maher on 03/12/2013 02:06 PM

     

    How is the studentID parameter value populated?

     

    Excuse me, but I do not understand your question.

     

    What means "parameter value populated"?

     

    Anyway, thank you very much for your attention and your help!

     

  • pcastagnaro_709's avatar
    pcastagnaro_709
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2013

     

    Posted By nathan on 03/12/2013 02:58 PM

     

    Dependant on the answer to Mike's question could a flow policy work for you?

     

     

    Rgds

     

    N

     

    I think flow policy involves into a vulnerability, because if an attacker wants to access /student_data/academic_data.jsp?studentID=AAA12345 he could do the request, tamper this adding Referer header, and application will show him page requested.

     

     

    Is that correct?

     

  • Mike_Maher's avatar
    Mike_Maher
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2013
    How does the parameter studenID gets its value? My assumption would be that this parameter gets populated at the login page so I would set up studentID to be a Dynamic parameter value and set the extraction point to be the page at which the parameter value should be populated. That way the value can only be set or changed by information gathered and passed during the login process. Which I would assume would be password protected and therefore should resolve your concern about being able to tamper with the value in other parts of the page.

     

     

    To further tighten this down you would want to implement flows was well and define a login page so that everyone has to start at the login page and cannot get to authenticated pages unless they come from the login page first. Yes this can be bypassed by crafting requests and messing with the refer but it will take away some of the ease of it
  • pcastagnaro_709's avatar
    pcastagnaro_709
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2013
    Dear Mike Maher,

     

     

    Thank you very much for your help.

     

    Is a good point search where the parameter studenID gets its value and then, set up studentID to be a Dynamic parameter value and set the extraction point to be the page at which the parameter value should be populated.

     

     

    I will do that next days, because BIG IP is installed in one of my clients and I depend on your schedule
  • SunHuHwang_1815's avatar
    SunHuHwang_1815
    Icon for Nimbostratus rankNimbostratus
    Feb 04, 2016

    please referer below. (v12.0.0)

     

    1. Parameter
      • add in parameter list : studentID
      • Object change - Parameter Value Type : dynamic contents value
      • Extraction > Extract From URLs : /student_data/academic_data.jsp
    2. Blocking setting : Illegal dynamic parameter value - check
    3. Apply policy