DirectAccesstoAdministrationPages
Created by: armorcodegithubpreprod[bot]
Threat Class :Predictable Resource Location Reason :AppScan requested a file which is probably not a legitimate part of the application. The response status was 200 OK. This indicates that the test succeeded in retrieving the content of the requested file. Technical Description :A common user can access certain pages on a site through simple surfing (i.e. following web links). However, there might be pages and scripts that are not accessible through simple surfing, (i.e. pages and scripts that are not linked). An attacker may be able to access these pages by guessing their name, e.g. admin.php, admin.asp, admin.cgi, admin.html, etc. Example request for a script named "admin.php": http://[SERVER]/admin.php Access to administration scripts should not be allowed without proper authorization, as it may allow an attacker to gain privileged rights. Sample Exploit: http://[SERVER]/admin.php http://[SERVER]/admin.asp http://[SERVER]/admin.aspx http://[SERVER]/admin.html http://[SERVER]/admin.cfm http://[SERVER]/admin.cgi Risk :It might be possible to escalate user privileges and gain administrative permissions over the web application
Mitigation: Do not allow access to administration scripts without proper authorization, as it may allow an attacker to gain privileged rights.