noorqureshi/security-skills/api-bola

Broken Object/Function Level Authorization (BOLA/BFLA)

When it applies

An API exposes objects (BOLA) or privileged functions (BFLA) and enforces authorization weakly. The API version of IDOR — but APIs multiply the surface (many endpoints, verbs, versions, and a mobile client that trusts the server less than the web UI does).

Why it works

APIs are stateless and object-centric; each endpoint must independently check "can this token act on this object/function?". Teams centralize authentication but scatter (or forget) authorization, and hide admin functions in the client instead of the server.

Method

1. BOLA: with two tokens, request another user's object id on every endpoint & verb; also

try guessing/incrementing ids and IDs leaked from list endpoints.

1. BFLA: take an admin-only call (from JS, mobile, or docs) and replay it with a low-priv

token; try method swaps (GET→PUT/DELETE) and hidden verbs the UI never issues.

1. Version & shadow endpoints: /api/v1/ may lack fixes present in /v2/; /internal/,

/debug/, Swagger/OpenAPI docs reveal ungoverned routes.

1. Automate with Burp Autorize (low-priv token as the "enforcement" session) to flag

every request that succeeds when it shouldn't.

Gotchas

• 200 vs 403 is the tell, but some APIs return 200 with an empty body — diff the content.
• IDs as UUIDs still leak via list/search endpoints and other objects' relations.
• Rate-limit and WAF differ per API version — the vuln may only show on an older route.

Verify success

A low-privilege (or cross-tenant) token successfully reads/modifies an object or invokes a function reserved for another user/role.

References

OWASP API Security Top 10 (2023) API1/API5; PortSwigger access-control labs.