Broken Object Level Authorization - Merchant Payments - Payment By ID

Kerentanan

[PASS] Broken Object Level Authorization - Merchant Payments - Payment By ID

Deskripsi

Pengujian berupaya membaca detail satu transaksi milik merchant lain melalui /api/v1/payments/<payment_id> menggunakan API key merchant yang berbeda.

Dampak

Tidak ada dampak. Kontrol bertahan: endpoint membatasi pencarian pada transaksi milik merchant pemegang API key, sehingga permintaan lintas merchant dijawab Payment not found alih-alih membocorkan data. Catatan: endpoint lain pada modul yang sama TIDAK menerapkan pembatasan ini. /api/v1/payments/merchant_id/<merchant_id> mengembalikan transaksi merchant lain dan dilaporkan terpisah sebagai temuan Broken Object Level Authorization - Merchant Payments - Payments By Merchant.

CWE

CWE-639: Authorization Bypass Through User-Controlled Key

OWASP

A01:2021 - Broken Access Control

Skenario

Normal: ScopeShopA membaca transaksinya sendiri berdasarkan payment_id memakai API key miliknya -> berhasil. Percobaan: ScopeShopB membaca payment_id yang sama memakai API key miliknya sendiri -> ditolak dengan Payment not found.

Endpoint

GET http://127.0.0.1:5001/api/v1/payments/<payment_id>

Fitur terdampak

Pembayaran merchant (detail transaksi per id)

Rekomendasi perbaikan

- Pertahankan pembatasan pencarian transaksi berdasarkan merchant pemilik API key. - Terapkan pola yang sama pada seluruh endpoint modul pembayaran, khususnya /api/v1/payments/merchant_id/<merchant_id> yang saat ini belum membatasi.

Bukti konsep

1. (Screenshot 1) NORMAL: ScopeShopA membaca transaksinya sendiri memakai API key miliknya -> berhasil.
2. (Screenshot 2) PERCOBAAN: ScopeShopB membaca payment_id yang sama memakai API key miliknya -> ditolak dengan Payment not found, kontrol bertahan.

Rekaman lengkap

LAB Semua target adalah sistem lab. Tidak ada satu pun yang merupakan pekerjaan klien. Bukti ditampilkan apa adanya; secret dihitamkan.

HTTP request

GET /api/v1/payments/2 HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive
X-Merchant-Api-Key: vk_e14704c2e08923caa90cd6b2b939d13bd413b8338852903e96d41e7ad1e55ee2

HTTP response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 796
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:13:16 GMT

{
  "debug_info": {
    "looked_up_by_merchant": {
      "api_key": "[REDACTED-LAB-VALUE]",
      "auth_method": "api_key",
      "created_at": "2026-09-30 03:13:16.469526",
      "email": "[REDACTED-EMAIL]",
      "id": 5,
      "is_active": true,
      "name": "None"
    }
  },
  "payment": {
    "amount": 42.0,
    "authorization_code": null,
    "card_id": null,
    "card_number": null,
    "created_at": "2026-09-30 03:13:16.487849",
    "currency": "USD",
    "cvv": null,
    "failure_reason": "invalid_card_number",
    "id": 2,
    "merchant_email": "[REDACTED-EMAIL]",
    "merchant_id": 5,
    "merchant_name": "None",
    "merchant_order_id": null,
    "payment_status": "failed"
  },
  "status": "success"
}

HTTP request

GET /api/v1/payments/2 HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive
X-Merchant-Api-Key: vk_cab3c9da252d39d384da572a2f04ad33c30cc92f166c33adaaac2533ebd385c9

HTTP response

HTTP/1.1 404 NOT FOUND
Content-Type: application/json
Content-Length: 79
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:13:17 GMT

{
  "message": "Payment not found",
  "payment_id": 2,
  "status": "error"
}

← Kasus sebelumnya: Broken Object Level Authorization - GraphQL - Transaction Summary Kasus berikutnya: Broken Object Level Authorization - Merchant Payments - Payments By Merchant →