Muhammad FaqihApplication security · Penetration testing
Test case 22 / 26PASS

Broken Function Level Authorization - Admin - Administrative Endpoints

Lab environment — not a production system

Screenshots and raw traffic are not translated; text within them may be in another language.

vuln-bank/Evidence/[PASS] Broken Function Level Authorization - Admin - Administrative Endpoints

01 — Notes

Test notes

Vulnerability

[PASS] Broken Function Level Authorization - Admin - Administrative Endpoints

Description

The test attempted to call administrative functions directly with an ordinary user token, bypassing the admin panel interface. Tested endpoints included creating a new administrator, deleting accounts, and suspending accounts.

Impact

No impact. Control holds: all three administrative endpoints check the caller's role and reject ordinary user tokens with HTTP 403. Calling them directly without going through the interface grants no additional privileges. Important note: this control is only as safe as the role claim in the token. Because the is_admin claim is read from the token and the token signature is not verified correctly, this role check can be bypassed with a forged token, as proven in the JWT Signature Not Verified finding.

CWE

CWE-285: Improper Authorization

OWASP

A01:2021 - Broken Access Control

Scenario

An ordinary user token was used to call /admin/create_admin, /admin/delete_account/3, and /admin/toggle_suspension/3 directly. Result: all were rejected with HTTP 403.

Endpoint

POST http://127.0.0.1:5001/admin/create_admin POST http://127.0.0.1:5001/admin/delete_account/<user_id> POST http://127.0.0.1:5001/admin/toggle_suspension/<user_id>

Affected feature

Administrative functions (create admin, delete account, suspend account)

Remediation

- Keep the role check on all administrative endpoints. - Fetch the role from the database using the token subject rather than from a claim inside the token, so this control cannot be bypassed with a forged token.

Proof of concept

1) (Screenshot 1) ATTEMPT: an ordinary user token calls /admin/create_admin -> HTTP 403, control holds. 2) (Screenshot 2) ATTEMPT: an ordinary user token calls /admin/delete_account/3 -> HTTP 403, control holds. 3) (Screenshot 3) ATTEMPT: an ordinary user token calls /admin/toggle_suspension/3 -> HTTP 403, control holds.
View source note (English)
Vulnerability:
[PASS] Broken Function Level Authorization - Admin - Administrative Endpoints

Description:
The test attempted to call administrative functions directly with an ordinary user token, bypassing the admin panel interface. Tested endpoints included creating a new administrator, deleting accounts, and suspending accounts.

Impact:
No impact. Control holds: all three administrative endpoints check the caller's role and reject ordinary user tokens with HTTP 403. Calling them directly without going through the interface grants no additional privileges.

Important note: this control is only as safe as the role claim in the token. Because the is_admin claim is read from the token and the token signature is not verified correctly, this role check can be bypassed with a forged token, as proven in the JWT Signature Not Verified finding.

CWE:
CWE-285: Improper Authorization

OWASP:
A01:2021 - Broken Access Control

Scenario:
An ordinary user token was used to call /admin/create_admin, /admin/delete_account/3, and /admin/toggle_suspension/3 directly. Result: all were rejected with HTTP 403.

Endpoint:
POST http://127.0.0.1:5001/admin/create_admin
POST http://127.0.0.1:5001/admin/delete_account/<user_id>
POST http://127.0.0.1:5001/admin/toggle_suspension/<user_id>

Affected Feature:
Administrative functions (create admin, delete account, suspend account)

Remediation:
- Keep the role check on all administrative endpoints.
- Fetch the role from the database using the token subject rather than from a claim inside the token, so this control cannot be bypassed with a forged token.

POC:
1) (Screenshot 1) ATTEMPT: an ordinary user token calls /admin/create_admin -> HTTP 403, control holds.
2) (Screenshot 2) ATTEMPT: an ordinary user token calls /admin/delete_account/3 -> HTTP 403, control holds.
3) (Screenshot 3) ATTEMPT: an ordinary user token calls /admin/toggle_suspension/3 -> HTTP 403, control holds.

02 — Screenshots

Screenshots (3)

01 / 1
02 / 2
03 / 3

03 — Requests and responses

HTTP captures

Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.

CAPTURE 01 / 1
HTTP request
POST /admin/create_admin HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive
Authorization: Bearer [REDACTED-LAB-TOKEN]
Content-Type: application/json
Content-Length: 49

{"username": "bfla_admin", "password": "[REDACTED-LAB-VALUE]"}
HTTP response
HTTP/1.1 403 FORBIDDEN
Content-Type: application/json
Content-Length: 31
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:13:10 GMT

{
  "error": "Access Denied"
}
CAPTURE 02 / 2
HTTP request
POST /admin/delete_account/3 HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive
Authorization: Bearer [REDACTED-LAB-TOKEN]
Content-Type: application/json
Content-Length: 2

{}
HTTP response
HTTP/1.1 403 FORBIDDEN
Content-Type: application/json
Content-Length: 31
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:13:11 GMT

{
  "error": "Access Denied"
}
CAPTURE 03 / 3
HTTP request
POST /admin/toggle_suspension/3 HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive
Authorization: Bearer [REDACTED-LAB-TOKEN]
Content-Type: application/json
Content-Length: 2

{}
HTTP response
HTTP/1.1 403 FORBIDDEN
Content-Type: application/json
Content-Length: 31
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:13:12 GMT

{
  "error": "Access Denied"
}