Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is an access bypass vulnerability?

In one sentence: An access bypass is a flaw that lets someone reach a page, system or action without passing the login or permission check that is meant to stand in front of it.

What it is

Most systems have two gates. The first asks who you are (authentication). The second asks what you are allowed to do (authorisation). An access bypass means an attacker finds a way around one of them.

MITRE describes one common form as a product that requires authentication but has an alternate path or channel that does not. OWASP, which ranks broken access control first in its Top 10, describes the wider family: users acting outside their intended permissions, which typically leads to data being disclosed, changed or destroyed.

How it works

  1. The attacker finds something that should be protected, such as an admin page, a remote access gateway or an API.
  2. They look for a route that skips the check. OWASP lists the usual ones: changing the URL or a parameter, changing the page or request, using a tool that edits API requests, or simply browsing straight to a privileged address (forced browsing).
  3. If the server trusts what it receives, it hands over the protected content or performs the action.
  4. The attacker uses that access. MITRE’s examples include reading system logs from a router without logging in, and a direct request to an installation file that let an attacker create administrator accounts.

Who it affects and how badly

Any organisation with something internet-facing that is meant to be private, usually a vendor product (a VPN or remote access gateway, a router) or a custom web app or API.

  • Sole trader to 10 staff: the exposure is usually the gateway or router you bought. Worst case: an attacker sits inside your remote access unseen.
  • 10 to 50 staff: accountancy, legal and recruitment firms with client or candidate portals risk one person seeing another’s files.
  • 50 to 250 staff: SaaS start-ups, MSPs and councils face lost trust, downtime while accounts are reset, and an investigation.
  • Regulated businesses (fintech, insurance, healthcare, telecoms): a bypass that exposes personal data is a security failure the regulator can look at, in the UK, EU, US and Armenia alike.

Real examples

  • Ivanti Connect Secure and Policy Secure (CVE-2023-46805). The US National Vulnerability Database (NVD) describes an authentication bypass in the web component that lets a remote attacker reach restricted resources by bypassing control checks. The NVD record shows it was added to CISA’s Known Exploited Vulnerabilities catalogue on 10 January 2024.

How to detect it

  • Check every internet-facing device against vendor advisories and the CISA Known Exploited Vulnerabilities list.
  • Read web server logs for requests to admin addresses that succeed with no login event before them. OWASP advises alerting on repeated access control failures.
  • In Microsoft 365, search the audit log in the Microsoft Purview portal for unexpected admin actions. It is on by default for enterprise tenants, and you can confirm it with `Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled` in Exchange Online PowerShell.

How to fix or prevent it

  1. Install vendor security updates for internet-facing devices first, and apply any published mitigation straight away.
  2. Deny by default: except for genuinely public resources, access is refused unless a rule allows it (OWASP).
  3. Enforce checks in trusted server-side code, written once and reused everywhere (OWASP), so there is a single choke point (MITRE).
  4. Take management interfaces off the internet, or restrict them to a VPN or a list of approved addresses.
  5. Keep backup files and `.git` folders out of web roots, and turn off directory listing (OWASP).
  6. Rate limit API access, and log and alert on access control failures (OWASP).

Related terms

Frequently asked questions

What is the difference between access bypass and missing authorization?
In a bypass the check exists but can be skipped through another path. With missing authorization the check was never written.

Does multi-factor authentication stop an access bypass?
Not on its own. If an alternate path skips the login step, the second factor is skipped too, so patching and server-side checks matter.

Where should I look first on my own estate?
At anything reachable from the internet that is meant to be private, such as remote access gateways and admin pages, checked against vendor advisories.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.