Broken Object Level Authorization - Workshop - Mechanic Report (Unauthenticated)

Kerentanan

[PASS] Broken Object Level Authorization - Workshop - Mechanic Report (Unauthenticated)

Deskripsi

Diuji akses endpoint mechanic_report tanpa autentikasi.

Dampak

Tidak ada dampak: server mewajibkan autentikasi dan menolak (401).

CWE

CWE-306: Missing Authentication for Critical Function (diuji, tidak rentan pada jalur ini)

OWASP

API1:2023 - Broken Object Level Authorization (diuji negatif - jalur unauth)

Skenario

Normal: baca report dengan token -> 200. Eksploitasi: hapus token -> 401. PASS (kontrol autentikasi berjalan).

Endpoint

GET http://127.0.0.1:8888/workshop/api/mechanic/mechanic_report?report_id={id}

Fitur terdampak

Laporan Servis Mekanik (crapi-workshop)

Rekomendasi perbaikan

Pertahankan wajib-autentikasi; tambahkan verifikasi kepemilikan objek (lihat [FAIL] terkait).

Bukti konsep

1. (Screenshot 1) NORMAL: GET mechanic_report?report_id=1 dengan token -> 200.
2. (Screenshot 2) EKSPLOITASI: kirim ulang TANPA header Authorization -> 401 (kontrol autentikasi berjalan).

Rekaman lengkap

LAB Semua target adalah sistem lab. Tidak ada satu pun yang merupakan pekerjaan klien. Bukti ditampilkan apa adanya; secret dihitamkan.

Normal: laporan dengan token (terautentikasi)

Alur normal: membaca laporan mekanik dengan token valid mendapat respons 200.

HTTP request

GET /workshop/api/mechanic/mechanic_report?report_id=1 HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 479

{
  "id": 1,
  "mechanic": {
    "id": 1,
    "mechanic_code": "TRAC_JHN",
    "user": {
      "email": "[REDACTED-EMAIL]",
      "number": ""
    }
  },
  "vehicle": {
    "id": 3,
    "vin": "0NKPZ09IHOP508673",
    "owner": {
      "email": "[REDACTED-EMAIL]",
      "number": "9876570001"
    }
  },
  "problem_details": "My car BMW - 5 Series is having issues.\nCan you give me a call on my mobile 9876570001,\nOr send me an email at [REDACTED-EMAIL]\nThanks,\nRobot.\n",
  "status": "pending",
  "created_on": "28 September, 2026, 14:28:07",
  "updated_on": null,
  "comments": []
}

Hasil: akses laporan tanpa token ditolak (PASS)

Hasil (PASS): akses tanpa token mendapat response 401. Autentikasi berjalan pada pengujian ini, tetapi BOLA tetap terjadi dengan token pengguna lain; lihat [FAIL].

HTTP request

GET /workshop/api/mechanic/mechanic_report?report_id=1 HTTP/1.1
Host: 127.0.0.1:8888
Accept: application/json

# HEADER Authorization SENGAJA DIHAPUS

HTTP response

HTTP/1.1 401 Unauthorized
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 33

{
  "message": "JWT Token required!"
}

← Kasus sebelumnya: Broken Object Level Authorization - Workshop - Mechanic Report Kasus berikutnya: Improper Inventory Management - Authentication - OTP Endpoint Versions →