Privilege escalation
Privilege escalation is the acquisition or exercise of permissions or capabilities beyond those originally granted to a user, process, service, or workload.
Secure APIs
Privilege escalation is the gaining of permissions or capabilities beyond those originally authorized for a user, service, or process.
- How it is used
- Frames unauthorized role access as an API threat, design concern, implementation flaw, and operational testing target.
- How deep it goes
- Defines vertical and horizontal escalation, explains common causes and chains, and provides authorization tests and mitigation checks.
- Examples
- Uses student access to GET /admin/students, internal SSRF requests, mass-assigned payment fields, and pytest-style 403 assertions.
- What you can do after
- Diagnose/debug with it by modeling role threats, testing unauthorized requests, and hardening endpoint, token, input, and network controls.
PostgreSQL Mistakes and How to Avoid Them
Privilege escalation is the acquisition or exercise of permissions beyond those originally granted to a user or process.
- How it is used
- Prevents unauthorized database access and destructive actions caused by overly powerful ownership, function execution, or object resolution.
- How deep it goes
- Explains concrete PostgreSQL escalation paths and mitigations, including roles, schema CREATE controls, function grants, and safe search paths.
- Examples
- Uses superuser-owned views, SHOW search_path output, REVOKE CREATE on public, and a sales-reporting SECURITY DEFINER function.
- What you can do after
- Operate/configure PostgreSQL roles, schemas, search paths, and SECURITY DEFINER functions to limit escalation opportunities.
Read how PostgreSQL Mistakes and How to Avoid Them explains privilege escalation →
Google Anthos in Action
Privilege escalation is the acquisition of permissions or capabilities beyond those initially granted to a process or workload.
- How it is used
- Secures Kubernetes clusters by restricting container capabilities that could affect the host system.
- How deep it goes
- Explains privileged containers, root execution, and policy enforcement trade-offs, but stops short of configuration commands.
- Examples
- Uses host breakout through the privileged flag, root-based public images, and Gatekeeper as concrete security examples.
- What you can do after
- Apply safeguards that prevent containers from escalating privileges or running as root by default.
Read how Google Anthos in Action explains privilege escalation →
Related concepts
- SSRFproduced by · Server-side request forgery is an attack in which an adversary induces a server to send requests to attacker-selected internal or external network resources.
- overpostingproduced by · Overposting is a security vulnerability in which client-supplied fields are automatically bound to application properties that were not intended for client modification.
- security definerproduced by · SECURITY DEFINER is a PostgreSQL function execution mode that runs the function with the privileges of its owner rather than its caller.
- role-based access controladdressed by · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.