Muhammad FaqihApplication security · Penetration testing
Test case 13 / 19PASS

Broken Object Level Authorization - Shop - Return Order

Lab environment — not a production system

Screenshots and raw traffic are not translated; text within them may be in another language.

crAPI/Evidence/[PASS] Broken Object Level Authorization - Shop - Return Order

01 — Notes

Test notes

Vulnerability

[PASS] Broken Object Level Authorization - Shop - Return Order

Description

Tested whether the order return action (return_order) is vulnerable to BOLA by attempting to return an order belonging to another user.

Impact

No impact: the server enforces ownership authorization and rejects the request (403).

CWE

CWE-639: Authorization Bypass Through User-Controlled Key (tested, not vulnerable)

OWASP

API1:2023 - Broken Object Level Authorization (negative test)

Scenario

Exploitation: return_order?order_id=1 (not owned by the attacker) -> 403. PASS (control holds, CIA not violated).

Endpoint

POST http://127.0.0.1:8888/workshop/api/shop/orders/return_order?order_id={id}

Affected feature

Order Return (crapi-workshop)

Remediation

Keep the ownership check on the return action (the current state is correct).

Proof of concept

1) (Screenshot 1) EXPLOITATION: POST return_order?order_id=1 (an order owned by another user) with the attacker token -> 403 "You are not allowed to access this resource!" (control holds).
View source note (English)
Vulnerability: [PASS] Broken Object Level Authorization - Shop - Return Order

Description:
Tested whether the order return action (return_order) is vulnerable to BOLA by attempting to return an order belonging to another user.

Impact:
No impact: the server enforces ownership authorization and rejects the request (403).

CWE:
CWE-639: Authorization Bypass Through User-Controlled Key (tested, not vulnerable)

OWASP:
API1:2023 - Broken Object Level Authorization (negative test)

Scenario:
Exploitation: return_order?order_id=1 (not owned by the attacker) -> 403. PASS (control holds, CIA not violated).

Endpoint:
POST http://127.0.0.1:8888/workshop/api/shop/orders/return_order?order_id={id}

Affected Feature:
Order Return (crapi-workshop)

Remediation:
Keep the ownership check on the return action (the current state is correct).

POC:
1) (Screenshot 1) EXPLOITATION: POST return_order?order_id=1 (an order owned by another user) with the attacker token -> 403 "You are not allowed to access this resource!" (control holds).

02 — Screenshots

Screenshots (1)

01 / Result: another user's return rejected (PASS)

Result (PASS): an attempt to return another user's order (order_id=1) is rejected with 403. Object-level authorization held in this test; no impact on confidentiality, integrity or availability was observed.

03 — Requests and responses

HTTP captures

Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.

CAPTURE 01 / 1Result: another user's return rejected (PASS)
HTTP request
POST /workshop/api/shop/orders/return_order?order_id=1 HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
HTTP response
HTTP/1.1 403 Forbidden
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 58

{
  "message": "You are not allowed to access this resource!"
}

Result (PASS): an attempt to return another user's order (order_id=1) is rejected with 403. Object-level authorization held in this test; no impact on confidentiality, integrity or availability was observed.