Skip to main content

​
Access Control Vulnerabilities

Access control vulnerabilities occur when users can access resources or perform actions beyond their intended permissions. AIPTx comprehensively tests authorization mechanisms.

​
Insecure Direct Object References (IDOR)

​
What is IDOR?

IDOR occurs when an application uses user-supplied input to access objects directly without proper authorization checks.

​
Testing Methodology

AIPTx tests IDOR by:
  1. Object ID Discovery - Identifying all object references
  2. Permission Boundary Testing - Accessing objects across user contexts
  3. Parameter Manipulation - Testing IDs, UUIDs, filenames
  4. Response Analysis - Comparing authorized vs unauthorized access

​
Common IDOR Locations

Endpoint PatternRiskExample
/api/users/{id}HighUser profile access
/api/orders/{id}HighOrder details
/api/documents/{id}CriticalSensitive documents
/api/invoices/{id}HighFinancial data
/download/{filename}CriticalFile download

​
Example Finding

{
  "title": "IDOR in Order API",
  "severity": "high",
  "endpoint": "GET /api/orders/12345",
  "description": "Any authenticated user can access any order by ID",
  "poc": {
    "authenticated_as": "[email protected]",
    "accessed_order": "Order #12345 belonging to [email protected]",
    "data_exposed": ["billing_address", "items", "total", "payment_method"]
  }
}

​
Privilege Escalation

​
Horizontal Privilege Escalation

Accessing resources of users with the same privilege level. 
{
  "title": "Horizontal Privilege Escalation",
  "description": "User A can modify User B's profile",
  "poc": {
    "attacker": "user_a (ID: 100)",
    "victim": "user_b (ID: 200)",
    "request": "PUT /api/users/200",
    "result": "Profile updated successfully"
  }
}

​
Vertical Privilege Escalation

Gaining elevated privileges beyond assigned role. 
{
  "title": "Vertical Privilege Escalation",
  "description": "Regular user can access admin functions",
  "poc": {
    "user_role": "user",
    "accessed_endpoint": "GET /api/admin/users",
    "result": "Full user list with admin data returned"
  }
}

​
Role Manipulation

Testing for role modification vulnerabilities: 
PUT /api/users/profile HTTP/1.1
Content-Type: application/json

{
  "name": "John Doe",
  "role": "admin"    // Role injection attempt
}

​
Missing Function Level Access Control

​
Unprotected Admin Endpoints

EndpointExpectedActual
/admin/dashboardAdmin onlyAll authenticated
/api/admin/usersAdmin onlyAll authenticated
/api/admin/configAdmin onlyPublic

​
Example Finding

{
  "title": "Missing Access Control on Admin API",
  "severity": "critical",
  "endpoint": "DELETE /api/admin/users/123",
  "description": "Admin endpoints lack role verification",
  "poc": {
    "user_role": "regular_user",
    "action": "Delete user account",
    "result": "User 123 deleted successfully"
  }
}

​
Forced Browsing

​
Testing Areas

  • Hidden admin pages
  • Backup files
  • Configuration files
  • Debug endpoints
  • API documentation

​
Common Paths Tested

/admin
/administrator
/console
/debug
/api/docs
/swagger
/graphql
/.env
/config.json
/backup

​
CORS Misconfiguration

​
Vulnerabilities Detected

IssueRiskDescription
Wildcard originCriticalAccess-Control-Allow-Origin: *
Null originHighAllows null origin
Origin reflectionHighReflects any origin
Credentials with wildcardCriticalExposes auth cookies

​
Example Finding

{
  "title": "CORS Misconfiguration Allows Credential Theft",
  "severity": "critical",
  "description": "API reflects origin and allows credentials",
  "poc": {
    "request_origin": "https://evil.com",
    "response_headers": {
      "Access-Control-Allow-Origin": "https://evil.com",
      "Access-Control-Allow-Credentials": "true"
    },
    "impact": "Attacker can steal user data via malicious site"
  }
}

​
Path Traversal

​
File Access Testing

# Basic traversal
../../../etc/passwd
..%2f..%2f..%2fetc/passwd

# Encoded variations
%2e%2e%2f
%252e%252e%252f
..%c0%af

# Null byte
../../../etc/passwd%00.png

​
Example Finding

{
  "title": "Path Traversal in File Download",
  "severity": "critical",
  "endpoint": "GET /api/files/download",
  "parameter": "filename",
  "poc": {
    "payload": "filename=../../../etc/passwd",
    "result": "Server configuration file contents returned"
  }
}

​
API Authorization Testing

​
REST API Testing

tests:
  - name: "User can only access own resources"
    steps:
      - login_as: user_a
      - request: GET /api/users/user_b/orders
      - expect: 403 Forbidden

  - name: "Users cannot modify other users"
    steps:
      - login_as: user_a
      - request: PUT /api/users/user_b
      - expect: 403 Forbidden

​
GraphQL Authorization

# Test unauthorized field access
query {
  user(id: "other_user_id") {
    email
    password    # Should be forbidden
    creditCards # Should be forbidden
  }
}

# Test mutation authorization
mutation {
  deleteUser(id: "other_user_id") {
    success
  }
}

​
Remediation Guidelines

// Always verify ownership
async function getOrder(orderId, userId) {
  const order = await Order.findById(orderId);

  if (!order) {
    throw new NotFoundError();
  }

  // Verify the order belongs to the user
  if (order.userId !== userId) {
    throw new ForbiddenError();
  }

  return order;
}

// Middleware for role checking
const requireRole = (allowedRoles) => {
  return (req, res, next) => {
    if (!allowedRoles.includes(req.user.role)) {
      return res.status(403).json({
        error: 'Insufficient permissions'
      });
    }
    next();
  };
};

// Usage
app.delete('/api/admin/users/:id',
  authenticate,
  requireRole(['admin']),
  deleteUser
);

const corsOptions = {
  origin: (origin, callback) => {
    const whitelist = [
      'https://app.example.com',
      'https://admin.example.com'
    ];

    if (whitelist.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization']
};

app.use(cors(corsOptions));