Missing Authorization (CWE-862) - Security Vulnerability

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource. When authorization checks are completely missing, any authenticated user can access protected resources.

보급률

높음

자주 악용됨

영향

높음

3개의 높은 심각도 규칙

예방

문서화됨

3개의 수정 예시

2 예방

이 취약점을 수정하는 방법

3개의 Shoulder 탐지 규칙을 기반으로 한 Missing Authorization 예방 전략.

🐹 Go 모두 보기 Go 자세히 →

LLM Excessive Agency HIGH

Require human approval for sensitive operations and limit agent loop iterations

+12 -1 go

- for _, toolCall := range resp.Choices[0].Message.ToolCalls {
+ var sensitiveOps = map[string]bool{
+     "deleteUser": true, "transferFunds": true, "sendEmail": true,
+ }
+ 
+ for i, toolCall := range resp.Choices[0].Message.ToolCalls {
+     if i >= maxIterations {
+         break
+     }
+     if sensitiveOps[toolCall.Function.Name] {
+         queueForApproval(toolCall)
+         continue
+     }
      result, _ := tools[toolCall.Function.Name](toolCall.Function.Arguments)
      results = append(results, result)
  }

3 탐지

코드에서 취약점 찾기

Shoulder를 사용하여 코드에서 Missing Authorization 패턴을 스캔하세요. 3 규칙.

터미널

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=862

# Or scan entire project
npx @shoulderdev/cli trust .

탐지 규칙 (3)

🐹 Go 1 rules

LLM Excessive Agency HIGH

Detects LLM implementations with excessive autonomy allowing destructive operations without human approval.

🟨 Javascript 1 rules

LLM Excessive Agency HIGH

Detects LLM implementations with excessive autonomy that can lead to unintended consequences. OWASP LLM08 - Excessive Agency. Excessive agency occurs when LLMs are granted: - Ability to perform destructive operations without confirmation - Auto-execution of LLM-generated code or commands - Direct database modifications without approval - Financial transactions without human oversight - Email/communication sending without review This rule detects: - Auto-execution of tool calls without human ap

🔷 Typescript 1 rules

LLM Excessive Agency HIGH

🐍 Python 1 rules

LLM Excessive Agency HIGH

4 경고 신호

코드 리뷰에서 주의할 점

이 패턴은 잠재적인 Missing Authorization 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.

🟠

Excessive LLM agency detected: ... go-llm-excessive-agency

🟠

LLM implementations with excessive autonomy allowing destructive operations without human approval go-llm-excessive-agency

🔍

코드베이스를 스캔하세요: Missing Authorization

Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.

npx shoulder trust 모든 규칙 보기