My Oracle Support Banner

Core || MWR Found That Strict Access Control (Doc ID 2797554.1)

Last updated on AUGUST 22, 2021

Applies to:

Oracle FLEXCUBE Universal Banking - Version 12.0.3 and later
Information in this document applies to any platform.

Symptoms

ACTUAL BEHAVIOR
---------------
It was observed that it was possible to bypass access controls in the FCUBS application by intercepting the requests and replacing the session cookies.
The Payment Maker user profile has the required privileges to add a new query in the customer signature and upload section of the application. However, this functionality is not available to the other user profiles such as the Payment Checker and Customer Service user profiles as the option to add a signature or image to the employee profile.

The user intercepted the request and replaced session cookies. For example, the Payment Maker user profile has the required privileges to add a new query in the customer signature and upload section of the application. However, this functionality is not available to the other user profiles such as the Payment Checker and Customer Service user profiles.
The workflow was initiated with the Payment Maker user profile to add a new query in the customer signature and upload section. However, by changing the session cookies on the request to a low privilege users session cookies such as the Payment Checker or Customer Service the request is still authorized.

EXPECTED BEHAVIOR
-----------------------
The user without the required privileges to any screen should not be able to access the screen.

STEPS
-----------------------
The issue can be reproduced at will with the following steps:
1. Open a screen with access only to one user say User1.
2. Change the session cookies to another user say User2, session cookies.
3. Try opening the screen with user2.


Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!


In this Document
Symptoms
Cause
Solution
References


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.