Muhammad FaqihApplication security · Penetration testing
Test case 14 / 19PASS

Broken Object Level Authorization - Vehicle - Location Tracking (Unauthenticated)

Lab environment — not a production system

Screenshots and raw traffic are not translated; text within them may be in another language.

crAPI/Evidence/[PASS] Broken Object Level Authorization - Vehicle - Location Tracking (Unauthenticated)

01 — Notes

Test notes

Vulnerability

[PASS] Broken Object Level Authorization - Vehicle - Location Tracking (Unauthenticated)

Description

Tested access to the vehicle location endpoint without any authentication.

Impact

No impact: the server requires authentication and rejects the request (401).

CWE

CWE-306: Missing Authentication for Critical Function (tested, not vulnerable on this path)

OWASP

API1:2023 - Broken Object Level Authorization (negative test - unauthenticated path)

Scenario

Normal: access your own location with a token -> 200. Exploitation: remove the token -> 401. PASS (authentication control holds).

Endpoint

GET http://127.0.0.1:8888/identity/api/v2/vehicle/{vehicleId}/location

Affected feature

Vehicle Location Tracking (crapi-identity)

Remediation

Keep the authentication requirement; additionally add object ownership verification (see the related [FAIL] finding).

Proof of concept

1) (Screenshot 1) NORMAL: GET /identity/api/v2/vehicle/9b3ce26b-d797-404b-a961-09d7e45e0d1b/location for your own vehicle with a token -> 200. 2) (Screenshot 2) EXPLOITATION: resend WITHOUT the Authorization header -> 401 (authentication control holds).
View source note (English)
Vulnerability: [PASS] Broken Object Level Authorization - Vehicle - Location Tracking (Unauthenticated)

Description:
Tested access to the vehicle location endpoint without any authentication.

Impact:
No impact: the server requires authentication and rejects the request (401).

CWE:
CWE-306: Missing Authentication for Critical Function (tested, not vulnerable on this path)

OWASP:
API1:2023 - Broken Object Level Authorization (negative test - unauthenticated path)

Scenario:
Normal: access your own location with a token -> 200. Exploitation: remove the token -> 401. PASS (authentication control holds).

Endpoint:
GET http://127.0.0.1:8888/identity/api/v2/vehicle/{vehicleId}/location

Affected Feature:
Vehicle Location Tracking (crapi-identity)

Remediation:
Keep the authentication requirement; additionally add object ownership verification (see the related [FAIL] finding).

POC:
1) (Screenshot 1) NORMAL: GET /identity/api/v2/vehicle/9b3ce26b-d797-404b-a961-09d7e45e0d1b/location for your own vehicle with a token -> 200.
2) (Screenshot 2) EXPLOITATION: resend WITHOUT the Authorization header -> 401 (authentication control holds).

02 — Screenshots

Screenshots (2)

01 / Normal: own vehicle location (authenticated)

Normal flow: accessing the location of your own vehicle with a valid token returns 200.

02 / Result: access without a token rejected (PASS)

Result (PASS): access without a token returns 401. Authentication held in this test, but BOLA is still possible with another user's token; see [FAIL].

03 — Requests and responses

HTTP captures

Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.

CAPTURE 01 / 1Normal: own vehicle location (authenticated)
HTTP request
GET /identity/api/v2/vehicle/9b3ce26b-d797-404b-a961-09d7e45e0d1b/location HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
HTTP response
HTTP/1.1 200
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 177

{
  "carId": "9b3ce26b-d797-404b-a961-09d7e45e0d1b",
  "vehicleLocation": {
    "id": 4,
    "latitude": "38.206348",
    "longitude": "-84.270172"
  },
  "fullName": "Muhammad Faqih",
  "email": "[REDACTED-EMAIL]"
}

Normal flow: accessing the location of your own vehicle with a valid token returns 200.

CAPTURE 02 / 2Result: access without a token rejected (PASS)
HTTP request
GET /identity/api/v2/vehicle/9b3ce26b-d797-404b-a961-09d7e45e0d1b/location HTTP/1.1
Host: 127.0.0.1:8888
Accept: application/json

# HEADER Authorization SENGAJA DIHAPUS
HTTP response
HTTP/1.1 401
Server: openresty/1.27.1.2
Content-Type: application/json;charset=ISO-8859-1
Content-Length: 49

CRAPIResponse(message=Invalid Token, status=401)

Result (PASS): access without a token returns 401. Authentication held in this test, but BOLA is still possible with another user's token; see [FAIL].