Medical Billing Access Control Test Found Data Exposure
What we tested
Wolfcore carried out access control testing on a medical billing company’s web application system. That means checking whether each type of user can reach only the data they are meant to.
What we found
Broken access control. Doctors and patients could reach data in the billing database that they should not have had access to. One user type was able to see other people’s records.
We have not described how, and we will not. The point for the business is the outcome: the application did not keep users inside their intended permissions.
Outcome
Wolfcore reported the findings with clear fix steps. A retest was offered.
Why access control testing matters
This section is general background, not a finding from the engagement.
Broken access control is a well-documented problem. OWASP defines access control as the policy that stops users acting outside their intended permissions, and says failures typically lead to unauthorised disclosure, modification or destruction of data (OWASP Top 10:2021, A01). In the data behind that list, 94% of applications were tested for some form of it, and it had the most occurrences of any category.
OWASP’s advice includes denying access by default and enforcing record ownership on the server, rather than assuming a signed-in user may read any record. A login alone does not do this. Knowing who someone is does not settle what they are allowed to see.
Test your own application
If your application holds records that belong to different users, an access control test is a sensible place to start. See our wider penetration testing service, or book a conversation.
Ruben Selby, founder and penetration tester at Wolfcore