Description.

Broken Object Level Authorization (BOLA): security vulnerability that occurs when authorization controls are lacking or missing, UserA will be able to request UserB’s (along with many other) resources

Key Aspects of BOLA:

1. Resource ID: The resource identifier specifies a unique resource (e.g., number)
2. Requests that access resources.
   you will need to know the requests that are necessary to obtain resources that your account should not be authorized to access.
3. Missing or flawed access controls.
   Absence of proper access controls, allowing unauthorized access to resources

Authorization Testing Strategy

When searching for authorization vulnerabilities the most effective way to find authorization weaknesses is to create two accounts and perform A-B testing. The A-B testing process consists of:

1. Create a UserA account.
2. Use the API and discover requests that involve resource IDs as UserA.
3. Document requests that include resource IDs and should require authorization.
4. Create a UserB account.
5. Obtaining a valid UserB token and attempt to access UserA’s resources

Checklist

—