Vertical Privilege Escalation

Vertical privilege escalation is a security vulnerability that allows an attacker to gain higher levels of permissions than those originally assigned to their account. This process involves the attacker moving up the privilege hierarchy by exploiting weaknesses in access controls, authentication, or authorization mechanisms. For instance, an attacker may escalate their privileges from a standard user account to that of an administrator, root, or another privileged role.

This is different from horizontal privilege escalation, where an attacker accesses resources belonging to another user with the same privilege level. Vertical privilege escalation involves gaining greater authority and control within a system or application.

How Vertical Privilege Escalation Works

1. Initial Access: The attacker first gains access to a lower-privileged account, such as a standard user account.
2. Exploitation of Privilege Weaknesses: The attacker identifies and exploits vulnerabilities, misconfigurations, or excessive permissions that enable them to obtain higher privileges.
3. Privilege Elevation: After successfully exploiting the weakness, the attacker gains elevated permissions and can perform actions restricted to higher-privileged users.

Vertical Privilege Escalation Impact

• Unauthorized Access to Sensitive Data: Ability to access protected files, databases, and confidential information.
• System Compromise: Ability to modify configurations, install malicious software, or disable security controls.
• Expanded Control: Ability to manage additional resources, users, or systems depending on the level of privileges obtained.
• Further Attacks: Elevated privileges may allow attackers to perform additional attacks, maintain persistence, or move to other systems.

Vertical Privilege Escalation Mitigation

• Principle of Least Privilege (PoLP): Grant users only the permissions required to perform their tasks.
• Regular Security Audits: Review user privileges, permissions, and configurations to identify excessive access.
• Patch Management: Keep operating systems and applications updated to reduce exposure to known vulnerabilities.
• Strong Authentication and Access Controls: Use multi-factor authentication (MFA) and enforce proper authorization policies.
• Role-Based Access Control (RBAC): Assign permissions based on job responsibilities and regularly review assigned roles.
• Monitoring and Logging: Detect suspicious privilege changes, unusual administrative activity, and unauthorized access attempts.

Vertical Privilege Escalation Example

Clone this current repo recursively

git clone --recurse-submodules https://github.com/qeeqbox/horizontal-privilege-escalation

Run the webapp using Python

python3 horizontal-privilege-escalation/vulnerable-web-app/webapp.py

Open the webapp in your browser 127.0.0.1:5142

Login as John (username: john and password: john - The threat actor stole this account)

John has access to the tickets only

Logout

Login as Joe (username: joe and password: joe - The threat actor stole this account)

Joe also has access to the tickets and sysinfo

Code

This logic checks if the user is logged in, then it renders sections based on the user's access

@logged_in
def render_home_page(self):
    content = b""
    cookies = SimpleCookie(self.headers.get('Cookie'))
    if "access" in cookies:
        for access in cookies["access"].value.split(","):
            content += getattr(self, f"{access}_section" , None)()
    return BASE_TEMPLATE.replace(b"{{body}}",content)