T05 · Unauthorized Access and Privilege Escalation
- Location
references/auth-jwt.md:69- Finding
Unconditional JWT Permission Claims Allow Privilege Escalation
- Content
View full analysis
Vulnerability Details
File Location:
references/auth-jwt.md, lines 69–80; authorization use at lines 106–128
Vulnerability Type: Improper authorization and excessive privilege assignment
Risk Level: HighVulnerable Code
csharp public (string access, string refresh) Generate(User user) { var claims = new[] { new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()), new Claim(JwtRegisteredClaimNames.Name, user.UserName), new Claim("tenant", user.TenantId), new Claim(ClaimTypes.Role, user.Role), // Permission claims used during authorization new Claim("permission", "order.read"), new Claim("permission", "order.write"), new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()) };The claims are subsequently trusted by authorization policies and protected endpoints:
csharp services.AddAuthorization(options => { // Role policy options.AddPolicy("AdminOnly", p => p.RequireRole("Admin")); // Permission policies options.AddPolicy("OrderRead", p => p.RequireClaim("permission", "order.read")); options.AddPolicy("OrderWrite", p => p.RequireClaim("permission", "order.write")); }); [Authorize(Policy = "OrderRead")] [HttpGet("{id}")] public async Task<IActionResult> Get(long id) { ... }Technical Analysis
The token-generation template unconditionally assigns both
order.readandorder.writeclaims to every user passed toGenerate. It does not retrieve or validate the user's actual permissions from a trusted authorization store.The documented authorization policies then treat possession of these claims as sufficient evidence of authorization. Consequently, authentication implicitly grants order read and write privileges, defeating the intended distinction between ordinary authenticated users and users authorized for those op ...[truncated 1605 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all unconditional permission claims from the token-generation method.
- Resolve the authenticated user's effective permissions from a trusted server-side role or permission store.
- Scope permission resolution to the authenticated user and current tenant.
- Issue only permissions explicitly assigned to that principal, following deny-by-default and least-privilege principles.
- Validate that the user is active and that permission assignments have not been revoked before issuing or refreshing a token.
- Consider a permission-version or security-stamp claim so permission changes can invalidate previously issued tokens.
- Ensure refresh-token processing re-evaluates current permissions rather than copying stale authorization state.
- Add negative authorization tests demonstrating that a user without
order.writeneither receives that claim nor accesses endpoints protected by theOrderWritepolicy. - Independently enforce tenant and resource ownership constraints at the data-access or resource-authorization layer.