/detecting-broken-object-property-level-authorization

name: detecting-broken-object-property-level-authorization
description: Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive
  data exposure and mass assignment attacks.
domain: cybersecurity
subdomain: api-security
tags:
- api-security
- bopla
- owasp-api3
- mass-assignment
- excessive-data-exposure
- property-level-authorization
- api-testing
- penetration-testing
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01

Detecting Broken Object Property Level Authorization

Overview

Broken Object Property Level Authorization (BOPLA), classified as API3:2023 in the OWASP API Security Top 10, combines two related vulnerability classes: Excessive Data Exposure (API returning more data than needed) and Mass Assignment (API accepting more data than intended). Even when APIs enforce object-level authorization correctly, they may fail to control which specific properties of an object a user can read or modify. Attackers exploit this by reading sensitive properties from API responses or injecting additional properties into request bodies to modify fields they should not have access to.

When to Use

• When investigating security incidents that require detecting broken object property level authorization
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Target API with endpoints that return or accept object data
• API documentation or schema (OpenAPI spec preferred)
• Burp Suite or Postman for API request manipulation
• Multiple user accounts with different privilege levels
• Python 3.8+ with requests library for automated testing
• Authorization to perform security testing

Vulnerability Patterns

Excessive Data Exposure

The API returns object properties the client does not need:

// GET /api/v1/users/123
// Response includes sensitive fields the UI doesn't display:
{
  "id": 123,
  "username": "john_doe",
  "email": "john@example.com",
  "name": "John Doe",
  "ssn": "123-45-6789",           // Sensitive - not needed by UI
  "salary": 95000,                 // Sensitive - not needed by UI
  "internal_notes": "VIP client",  // Internal - should not be exposed
  "password_hash": "$2b$12...",    // Critical - never expose
  "role": "admin",                 // May enable privilege discovery
  "created_by": "system_admin",   // Internal metadata
  "credit_card_last4": "4242"     // PCI compliance violation
}

Mass Assignment

The API binds client-supplied data to internal object properties without filtering:

// Normal user update request
PUT /api/v1/users/123
Content-Type: application/json

{
  "name": "John Updated",
  "email": "new@example.com",
  "role": "admin",           // Attacker-injected: privilege escalation
  "is_verified": true,       // Attacker-injected: bypass verification
  "discount_rate": 100,      // Attacker-injected: business logic abuse
  "account_balance": 999999  // Attacker-injected: financial fraud
}

Testing Methodology

#!/usr/bin/env python3
"""BOPLA Vulnerability Scanner

Tests APIs for Broken Object Property Level Authorization
including Excessive Data Exposure and Mass Assignment.
"""

import requests
import json
import sys
from typing import Dict, List, Optional, Set
from dataclasses import dataclass, field
from copy import deepcopy

@dataclass
class BOPLAFinding:
    endpoint: str
    method: str
    vulnerability_type: str  # "excessive_exposure" or "mass_assignment"
    severity: str
    property_name: str
    details: str

class BOPLAScanner:
    SENSITIVE_PROPERTY_PATTERNS = {
        "critical": [
            "password", "password_hash", "secret", "token", "api_key",
            "private_key", "secret_key", "access_token", "refresh_token",
        ],
        "high": [
            "ssn", "social_security", "tax_id", "credit_card", "card_number",
            "cvv", "bank_account", "routing_number",
        ],
        "medium": [
            "salary", "income", "internal_notes", "admin_notes",
            "created_by", "modified_by", "ip_address", "session_id",
            "role", "permissions", "is_admin", "is_superuser", "privilege",
        ],
        "low": [
            "phone", "address", "date_of_birth", "dob", "age",
            "gender", "ethnicity", "religion",
        ]
    }

    MASS_ASSIGNMENT_FIELDS = [
        ("role", "admin"),
        ("is_admin", True),
        ("is_verified", True),
        ("is_active", True),
        ("email_verified", True),
        ("account_type", "premium"),
        ("discount_rate", 100),
        ("credit_limit", 999999),
        ("permissions", ["admin", "write", "delete"]),
        ("account_balance", 999999),
        ("subscription_tier", "enterprise"),
        ("rate_limit", 999999),
    ]

    def __init__(self, base_url: str, auth_headers: Dict[str, str]):
        self.base_url = base_url.rstrip('/')
        self.auth_headers = auth_headers
        self.findings: List[BOPLAFinding] = []

    def test_excessive_data_exposure(self, endpoint: str,
                                      expected_fields: Set[str]) -> List[BOPLAFinding]:
        """Test if API response contains more fields than expected."""
        findings = []
        url = f"{self.base_url}{endpoint}"

        try:
            response = requests.get(url, headers=self.auth_headers, timeout=10)
            if response.status_code != 200:
                return findings

            data = response.json()

            # Handle both single object and list responses
            objects = data if isinstance(data, list) else [data]
            if isinstance(data, dict) and "data" in data:
                objects = data["data"] if isinstance(data["data"], list) else [data["data"]]

            f