Privilege escalations in applications – often referred to as privilege escalation – are vulnerabilities that allow attackers or even regular users to access data, information or system functions for which they have no authorization. Attackers can take advantage of such gaps and, for example, manipulate or steal data without authorization.
There are two types of privilege escalation. In horizontal privilege escalation, a user can access data of other users who have the same privilege profile. In a digital health application, for example, a patient would then be able to read or manipulate other patients’ data. Vertical privilege escalation is another type of privilege escalation: Here, a user can also access information or program functionalities that are actually reserved for more highly privileged users. This is the case, for example, when a patient in a digital health application can also access administrative functions that are reserved for the “doctor” role.
Faulty configuration settings are often the cause of privilege escalations: Administrators have consciously or unconsciously assigned too extensive privileges to certain users.
The danger of privilege escalation also lurks in self-developed applications: if the access rules in applications are inadequately designed or user session management is poorly controlled, such gaps often occur.
Every organization that uses its own software or software developed by others should have it regularly checked for vulnerabilities. In extreme cases, rights expansions can lead to the theft of entire databases. Attackers then use these for ransomware extortion or sell the data to make a profit.
Regular penetration tests of your applications can reliably identify such gaps. Contact us – we will be happy to advise you!
Thomas Neeff 
