82/315 Which of the following threat types involves an application that does not validate authorization for portions of itself beyond when the user first enters it?

Missing function-level access control is a specific type of authorization flaw. It occurs when an application authenticates a user but fails to perform subsequent authorization checks for all functions or resources the user attempts to access. An attacker can exploit this by forging requests to "hidden" administrative or privileged functions that they are not authorized to use. The application incorrectly grants access because it only checked permissions at the initial entry point, not at the level of the specific function being called. This vulnerability is a subset of Broken Access Control.

A. Cross-site request forgery (CSRF) tricks a victim's browser into sending an unwanted request to an application they are logged into; it doesn't exploit a lack of authorization checks.

C. Injection flaws, such as SQL injection, involve tricking an application into executing unintended commands by inserting malicious data into input fields, not bypassing function-level authorization.

D. Cross-site scripting (XSS) is a client-side attack where malicious scripts are injected into trusted websites and executed in the victim's browser, not a server-side authorization failure.

1. OWASP Foundation. (2021). OWASP Top 10:2021. A01:2021-Broken Access Control. Retrieved from https://owasp.org/Top10/A012021-BrokenAccessControl/. (This document details that missing function-level access control is a common example of Broken Access Control).

2. Pauley, W. H. (2010). Web application security assessment: A practical guide for security testers and application developers. Courseware, SANS Institute. SEC542: Web App Penetration Testing and Ethical Hacking. (This courseware extensively covers function-level access control as a key area to test in web applications).

3. Viega, J., & McGraw, G. (2001). Building Secure Software: How to Avoid Security Problems the Right Way. Addison-Wesley. Chapter 6, "Access Control," discusses the principle of checking authorization for every requested function.