Skip to content

Commit 74b012d

Browse files
arjun-aktoarjun-akto
authored
Merge pull request #179 from akto-api-security/update/pro
10 x pro
2 parents 923a9d5 + eeccea9 commit 74b012d

File tree

10 files changed

+1224
-0
lines changed

10 files changed

+1224
-0
lines changed

‎Broken-Object-Level-Authorization/BOLAURLReplaceUserIDDELETE.yml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
id: BOLA_URL_REPLACE_USER_ID_DELETE
2+
info:
3+
name: "Exploiting BOLA by replacing URL path with User IDs for Unauthorized Access with DELETE method"
4+
description: >
5+
"This test involves exploiting security vulnerabilities by manipulating the URL path and substituting it with User IDs (APIs having DELETE Method). This unauthorized access allows attackers to bypass proper authorization mechanisms, potentially gaining unauthorized entry to sensitive data or functionalities. The test aims to identify and rectify weaknesses in object-level authorization, ensuring that only authorized users can access specific resources or perform certain actions within an application or system."
6+
details: >
7+
"In this test, attackers exploit security weaknesses by manipulating the URL path (APIs having DELETE method), substituting it with User IDs to gain unauthorized access. By doing so, they can bypass proper authorization controls, potentially accessing sensitive data or functionalities. This test helps identify and address vulnerabilities in object-level authorization, ensuring that only authorized users have legitimate access to specific resources or actions within a system or application."
8+
impact: >
9+
"The impact of a Broken Object Level Authorization (BOLA) test exploit can be severe, as unauthorized access to sensitive data or functionalities may compromise the confidentiality and integrity of a system. Attackers could potentially retrieve or manipulate critical information, leading to data breaches, unauthorized transactions, or even the compromise of user privacy. Addressing BOLA vulnerabilities is crucial to prevent these far-reaching consequences and maintain the security and trustworthiness of the system."
10+
category:
11+
name: BOLA
12+
shortName: BOLA
13+
displayName: Broken Object Level Authorization (BOLA)
14+
subCategory: BOLA_URL_REPLACE_USER_ID_DELETE
15+
severity: HIGH
16+
tags:
17+
- Business logic
18+
- OWASP top 10
19+
- HackerOne top 10
20+
references:
21+
- "https://www.akto.io/blog/bola-exploitation-using-unauthorized-uuid-on-api-endpoint"
22+
- "https://www.akto.io/blog/what-is-broken-object-level-authorization-bola"
23+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa1-broken-object-level-authorization.md"
24+
- "https://cwe.mitre.org/data/definitions/284.html"
25+
- "https://cwe.mitre.org/data/definitions/285.html"
26+
- "https://cwe.mitre.org/data/definitions/639.html"
27+
cwe:
28+
- CWE-284
29+
- CWE-285
30+
- CWE-639
31+
cve:
32+
- CVE-2022-34770
33+
34+
attributes:
35+
nature: INTRUSIVE
36+
plan: PRO
37+
duration: FAST
38+
39+
40+
auth:
41+
authenticated: true
42+
api_selection_filters:
43+
response_code:
44+
eq: 204
45+
method:
46+
eq: "DELETE"
47+
response_payload:
48+
length:
49+
gt: 0
50+
not_contains:
51+
- Error
52+
- Internal Server
53+
- Failed
54+
- Unauthorized
55+
- access denied
56+
- Forbidden
57+
- Method Not allowed
58+
- Gateway timeout
59+
- request timeout
60+
- server error
61+
- server busy
62+
- authentication error
63+
- authorization error
64+
- validation error
65+
- Permission Denied
66+
- invalid token
67+
- token expired
68+
- session expired
69+
- session timeout
70+
- unexpected error
71+
- unable to process request
72+
- bad request
73+
- service unavailable
74+
- account is locked
75+
- account is blocked
76+
- multiple failed attempts
77+
- failure
78+
- not available
79+
- not found
80+
81+
wordLists:
82+
random_ids:
83+
source: sample_data
84+
key:
85+
regex: "^UserId$|^UserID$|^User-ID$|^user_id$|^user-id$|^userid$|username|^Username$|^USERNAME$|^uId$|^uid$|^UID$|^member_id$|^MemberId$|^memberId$|^profile_id$|^ProfileId$|^profileId$|^userIdentifier$|^UserIdentifier$|^user_identifier$|^account_id$|^AccountID$|^account-id$|^account_id$|^customer_id$|^CustomerID$|^customer-id$|^customer_id$"
86+
all_apis: true
87+
88+
execute:
89+
type: multiple
90+
requests:
91+
- req:
92+
- modify_url:
93+
token_replace:
94+
location: 1
95+
replace_with: ${random_ids}
96+
- success: vulnerable
97+
- failure: x2
98+
- req:
99+
- modify_url:
100+
token_replace:
101+
location: 2
102+
replace_with: ${random_ids}
103+
- success: vulnerable
104+
- failure: x3
105+
- req:
106+
- modify_url:
107+
token_replace:
108+
location: 3
109+
replace_with: ${random_ids}
110+
- success: vulnerable
111+
- failure: x4
112+
- req:
113+
- modify_url:
114+
token_replace:
115+
location: 4
116+
replace_with: ${random_ids}
117+
validate:
118+
response_code:
119+
eq: 204
120+
response_payload:
121+
length:
122+
gt: 0
123+
percentage_match:
124+
lt: 10
125+
percentage_match_schema:
126+
gte: 90
127+
not_contains:
128+
- Error
129+
- Internal Server
130+
- Failed
131+
- Unauthorized
132+
- access denied
133+
- Forbidden
134+
- Method Not allowed
135+
- Gateway timeout
136+
- request timeout
137+
- server error
138+
- server busy
139+
- authentication error
140+
- authorization error
141+
- validation error
142+
- Permission Denied
143+
- invalid token
144+
- token expired
145+
- session expired
146+
- session timeout
147+
- unexpected error
148+
- unable to process request
149+
- bad request
150+
- service unavailable
151+
- account is locked
152+
- account is blocked
153+
- multiple failed attempts
154+
- failure
155+
- not available
156+
- not found
157+
- "<html>"
158+
- "</html>"

‎Broken-Object-Level-Authorization/BOLAURLReplaceUserIDPATCH.yml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
id: BOLA_URL_REPLACE_USER_ID_PATCH
2+
info:
3+
name: "Exploiting BOLA by replacing URL path with User IDs for Unauthorized Access with PATCH method"
4+
description: >
5+
"This test involves exploiting security vulnerabilities by manipulating the URL path and substituting it with User IDs (APIs having PATCH Method). This unauthorized access allows attackers to bypass proper authorization mechanisms, potentially gaining unauthorized entry to sensitive data or functionalities. The test aims to identify and rectify weaknesses in object-level authorization, ensuring that only authorized users can access specific resources or perform certain actions within an application or system."
6+
details: >
7+
"In this test, attackers exploit security weaknesses by manipulating the URL path (APIs having PATCH method), substituting it with User IDs to gain unauthorized access. By doing so, they can bypass proper authorization controls, potentially accessing sensitive data or functionalities. This test helps identify and address vulnerabilities in object-level authorization, ensuring that only authorized users have legitimate access to specific resources or actions within a system or application."
8+
impact: >
9+
"The impact of a Broken Object Level Authorization (BOLA) test exploit can be severe, as unauthorized access to sensitive data or functionalities may compromise the confidentiality and integrity of a system. Attackers could potentially retrieve or manipulate critical information, leading to data breaches, unauthorized transactions, or even the compromise of user privacy. Addressing BOLA vulnerabilities is crucial to prevent these far-reaching consequences and maintain the security and trustworthiness of the system."
10+
category:
11+
name: BOLA
12+
shortName: BOLA
13+
displayName: Broken Object Level Authorization (BOLA)
14+
subCategory: BOLA_URL_REPLACE_USER_ID_PATCH
15+
severity: HIGH
16+
tags:
17+
- Business logic
18+
- OWASP top 10
19+
- HackerOne top 10
20+
references:
21+
- "https://www.akto.io/blog/bola-exploitation-using-unauthorized-uuid-on-api-endpoint"
22+
- "https://www.akto.io/blog/what-is-broken-object-level-authorization-bola"
23+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa1-broken-object-level-authorization.md"
24+
- "https://cwe.mitre.org/data/definitions/284.html"
25+
- "https://cwe.mitre.org/data/definitions/285.html"
26+
- "https://cwe.mitre.org/data/definitions/639.html"
27+
cwe:
28+
- CWE-284
29+
- CWE-285
30+
- CWE-639
31+
cve:
32+
- CVE-2022-34770
33+
34+
attributes:
35+
nature: INTRUSIVE
36+
plan: PRO
37+
duration: FAST
38+
39+
40+
auth:
41+
authenticated: true
42+
api_selection_filters:
43+
response_code:
44+
eq: 204
45+
method:
46+
eq: "PATCH"
47+
response_payload:
48+
length:
49+
gt: 0
50+
not_contains:
51+
- Error
52+
- Internal Server
53+
- Failed
54+
- Unauthorized
55+
- access denied
56+
- Forbidden
57+
- Method Not allowed
58+
- Gateway timeout
59+
- request timeout
60+
- server error
61+
- server busy
62+
- authentication error
63+
- authorization error
64+
- validation error
65+
- Permission Denied
66+
- invalid token
67+
- token expired
68+
- session expired
69+
- session timeout
70+
- unexpected error
71+
- unable to process request
72+
- bad request
73+
- service unavailable
74+
- account is locked
75+
- account is blocked
76+
- multiple failed attempts
77+
- failure
78+
- not available
79+
- not found
80+
81+
wordLists:
82+
random_ids:
83+
source: sample_data
84+
key:
85+
regex: "^UserId$|^UserID$|^User-ID$|^user_id$|^user-id$|^userid$|username|^Username$|^USERNAME$|^uId$|^uid$|^UID$|^member_id$|^MemberId$|^memberId$|^profile_id$|^ProfileId$|^profileId$|^userIdentifier$|^UserIdentifier$|^user_identifier$|^account_id$|^AccountID$|^account-id$|^account_id$|^customer_id$|^CustomerID$|^customer-id$|^customer_id$"
86+
all_apis: true
87+
88+
execute:
89+
type: multiple
90+
requests:
91+
- req:
92+
- modify_url:
93+
token_replace:
94+
location: 1
95+
replace_with: ${random_ids}
96+
- success: vulnerable
97+
- failure: x2
98+
- req:
99+
- modify_url:
100+
token_replace:
101+
location: 2
102+
replace_with: ${random_ids}
103+
- success: vulnerable
104+
- failure: x3
105+
- req:
106+
- modify_url:
107+
token_replace:
108+
location: 3
109+
replace_with: ${random_ids}
110+
- success: vulnerable
111+
- failure: x4
112+
- req:
113+
- modify_url:
114+
token_replace:
115+
location: 4
116+
replace_with: ${random_ids}
117+
validate:
118+
response_code:
119+
eq: 204
120+
response_payload:
121+
length:
122+
gt: 0
123+
percentage_match:
124+
lt: 10
125+
percentage_match_schema:
126+
gte: 90
127+
not_contains:
128+
- Error
129+
- Internal Server
130+
- Failed
131+
- Unauthorized
132+
- access denied
133+
- Forbidden
134+
- Method Not allowed
135+
- Gateway timeout
136+
- request timeout
137+
- server error
138+
- server busy
139+
- authentication error
140+
- authorization error
141+
- validation error
142+
- Permission Denied
143+
- invalid token
144+
- token expired
145+
- session expired
146+
- session timeout
147+
- unexpected error
148+
- unable to process request
149+
- bad request
150+
- service unavailable
151+
- account is locked
152+
- account is blocked
153+
- multiple failed attempts
154+
- failure
155+
- not available
156+
- not found
157+
- "<html>"
158+
- "</html>"

0 commit comments

Comments
 (0)