Setting Manipulation: User-Controlled Approval Action

The application allows a user to define the action for processing an approval request, which can lead to fraudulent transactions or privilege escalation.

If users are allowed to control the action for processing an approval request, a malicious user can potentially reject legitimate requests or approve fraudulent ones, leading to data corruption, denial of service, or privilege escalation.

Example 1: The following code allows external user input to control the approval action in a ProcessWorkitemRequest.setAction() call.

void processRequest() {
  String workItemId = ApexPages.currentPage().getParameters().get('Id');
  String action = ApexPages.currentPage().getParameters().get('Action');

  Approval.ProcessWorkitemRequest req = new Approval.ProcessWorkitemRequest();
  req.setWorkitemId(workItemId);
  req.setAction(action);

  Approval.ProcessResult res =  Approval.process(req);
  ...
}

One way an attacker could exploit this code is by initially submitting an approval request to modify the roles or access permissions associated with their account. They could then tamper with the query parameters to ensure their request gets improperly approved, potentially resulting in unauthorized privilege escalation.