Broken Object Level Authorization - Accounts - Balance Lookup

Vulnerability:
[FAIL] Broken Object Level Authorization - Accounts - Balance Lookup

Description:
The /check_balance/<account_number> endpoint returns an account balance based on the account number in the path without checking that the account belongs to the token holder. A valid token is enough to read any account.

Impact:
Confidentiality (High): any customer can read the owner name and balance of other customers' accounts, including the administrator's account. Account numbers are also exposed by other endpoints in this application, so the balances of all customers can be mapped systematically.

CWE:
CWE-639: Authorization Bypass Through User-Controlled Key

OWASP:
A01:2021 - Broken Access Control

Scenario:
Normal: the attacker checks their own account balance -> expected. Exploitation: the account number is replaced with the victim's -> HTTP 200, the victim's name and balance are readable. Impact: the administrator account ADMIN001 is readable in the same way.

Endpoint:
GET http://127.0.0.1:5001/check_balance/<account_number>

Affected Feature:
Account balance lookup

Remediation:
- Derive the account number from the caller's token, not from the path.
- If the parameter is retained, verify account ownership before returning data.
- Avoid guessable account numbers and do not display other users' account numbers in any endpoint response.

POC:
1) (Screenshot 1) NORMAL: the attacker checks their own account balance.
2) (Screenshot 2) EXPLOITATION: the account number is replaced with the victim's -> HTTP 200, the victim's name and balance are exposed.
3) (Screenshot 3) CIA IMPACT: the administrator account ADMIN001 is read using an ordinary user token.