.NET Attribute Misuse: Authorization Bypass

The application bypasses authorization granted by the [Authorize] attribute with the use of an [AllowAnonymous] attribute at the class or method level.

ASP.NET Core allows for application actions to require authorization by adding the [Authorize] attribute to a class or a method. Additionally, the specified authorization requirement of an application class or method can be bypassed by adding the [AllowAnonymous] attribute. When both are specified, the [AllowAnonymous] attribute takes precedence and bypasses the [Authorize] attribute. This can result in the arbitrary and anonymous access of sensitive data and actions by an attacker.

Example 1: The following example shows the [AllowAnonymous] attribute at the class level overriding an [Authorize] attribute set on the method. The secretAction() method does not require authorization despite having the [Authorize] attribute.

...
[AllowAnonymous]
public class Authorization_Test
{
    [Authorize]
    public IActionResult secretAction()
    {
        
    }
}
...

Example 2: The following example shows the [AllowAnonymous] attribute at the class level of a superclass overriding an [Authorize] attribute set on the method of a subclass. Due to the inherited class Inherit_AA having the [AllowAnonymous] attribute, the secretAction() method does not require authorization despite specifying the [Authorize] attribute.

...
[AllowAnonymous]
public abstract class Inherit_AA
{
    
}

public class Authorization_Test:Inherit_AA
{
    [Authorize]
    public IActionResult secretAction()
    {
        
    }
}
...

Example 3: The following shows the [AllowAnonymous] attribute overriding an [Authorize] attribute at the method level with inheritance. Due to the inherited method secretAction() having the [AllowAnonymous] attribute, the secretAction() method does not require authorization despite specifying the [Authorize] attribute on the overriding method.

...
public abstract class Inherit_AA
{
    [AllowAnonymous]
    public abstract IActionResult secretAction()
    {
        
    }
}

public class Authorization_Test:Inherit_AA
{
    [Authorize]
    public override IActionResult secretAction()
    {
        
    }
}
...