What is the confused deputy problem?

Let’s look at a simple example first to understand the problem.

Suppose a client sends the names of an input file and an output file to the server. The server compiles the input file and stores it in the output file. Let’s also assume that the client has less privilege than the server.

Now, also assume that there is another file “restricted” on which the server has permission where the client does not. At this point, if the client sends an arbitrary input file and “restricted” as the output file, the server will compile the input file and write it to the file “restricted,” overwriting its previous content. Here, the client did not have permission to “restricted,” but the server had. So, the server here is a deputy who was exploited to perform a malicious action. This type of problem is called the confused deputy problem.

Is there any real-life example of the confused deputy problem?

There are a couple of real-life examples of the Confused Deputy Problem.

• Cross-site request forgery is an example of the confused deputy problem. Web applications usually use a cookie to authenticate all requests transmitted by a browser. An attacker can take advantage of that and use JavaScript to submit an authenticated HTTP request using the authority of the victim. (What is Cross-Site Request Forgery or CSRF Attack? )
• Clickjacking is another example of the confused deputy problem. A user visits an attacker-controlled website and thinks he is harmlessly browsing a site. But actually, he is tricked into acting like a confused deputy and performs sensitive actions to get infected by malware. (What is Clickjacking?)
• FTP Bounce Attack is an example of the confused deputy problem. In this attack, an attacker uses the PORT command and uses a victim machine’s FTP Server to get access to TCP ports to which the attacker himself has no permission to connect. Here, the FTP Server is the confused deputy. (What is an FTP Bounce Attack?)

How to prevent the confused deputy attack?

Confused deputy problems can be prevented by taking proper precautions. It can be prevented using capability-based security (What is capability-based security?). For example, in the example of the “restricted” file we gave above, we can make it mandatory for the client to send the input file along with the capability of the output file to the server, where the capability of a file is the name of the file along with the permission of the client on the file. As a result, if the client does not have permission on the output file, it won’t be able to overwrite it.

Similarly, in the example of Cross-site request forgery, a URL supplied by cross-site should use its own authority irrespective of the authority of the client or the web browser.

This article was an informative article on the confused deputy problem. Interested readers can find more information on different web application attacks in the book “Web Application Vulnerabilities And Prevention.”