API05: Broken Function Level Authorization

📋 What Is It?

Broken Function Level Authorization (BFLA) occurs when an API endpoint doesn't properly verify whether the authenticated user has the necessary privileges to execute a specific function. Regular users can access administrative or privileged operations intended only for elevated roles.

API05 OWASP Rank

Function Operation Level

Admin Target Functions

⚠️ Common Exploits

Admin Function Access: Regular user calls DELETE /api/users endpoint
HTTP Method Tampering: Change GET to DELETE to bypass controls
Hidden Endpoints: Discover undocumented admin endpoints via fuzzing
Role Parameter Manipulation: Send role=admin in request
Vertical Privilege Escalation: User executes admin-only operations
Lateral Movement: Access functions of different departments

🔴 Attack Flow

1. Attacker logs in as regular user
↓
2. Discovers admin endpoint via API docs/fuzzing
↓
3. Calls DELETE /api/admin/users/456
↓
4. API doesn't verify role/privileges
↓
5. BREACH: User deleted by regular user!

❌ Vulnerable Code

// Bad: No role check on admin function!
@app.route('/api/admin/users', methods=['DELETE'])
@login_required  ← Only checks authentication, not authorization!
def delete_user():
    user_id = request.json.get('user_id')
    User.query.filter_by(id=user_id).delete()
    return {'status': 'deleted'}

// Bad: Client-side role check only
// Frontend (JavaScript)
if (user.role === 'admin') {
    showDeleteButton();  ← UI hides button, but endpoint accessible!
}

// Bad: Hidden admin endpoints
// Documented:
GET  /api/users        # List users
POST /api/users        # Create user

// Undocumented but accessible:
DELETE /api/users/:id  # Delete user (no role check!)
PUT    /api/users/:id/promote  # Promote to admin!
                

✅ Secure Code

// Good: Proper role-based authorization
def require_admin(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if not current_user.is_admin:
            abort(403)  # Forbidden
        return f(*args, **kwargs)
    return decorated_function

@app.route('/api/admin/users', methods=['DELETE'])
@login_required
@require_admin  ← Verifies admin role!
def delete_user():
    user_id = request.json.get('user_id')
    User.query.filter_by(id=user_id).delete()
    return {'status': 'deleted'}

// Good: Permission-based authorization
def require_permission(permission):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            if not current_user.has_permission(permission):
                abort(403)
            return f(*args, **kwargs)
        return decorated_function
    return decorator

@app.route('/api/reports/financial')
@login_required
@require_permission('view_financial_reports')
def get_financial_report():
    return generate_report()

// Good: RBAC with multiple roles
@app.route('/api/config', methods=['PUT'])
@login_required
@require_roles(['admin', 'system_manager'])
def update_config():
    return apply_config(request.json)
                

✓ Prevention Checklist

Implement server-side role/permission checks
Deny access by default, whitelist allowed roles
Use decorators/middleware for authorization
Never rely on client-side role checks
Document all endpoints and their required roles
Test all HTTP methods (GET, POST, PUT, DELETE, PATCH)
Use RBAC (Role-Based Access Control)
Implement centralized authorization logic
Log authorization failures
Regular security audits of endpoints

🔍 Detection & Tools

Testing Tools:

Burp Suite OWASP ZAP Postman Insomnia FFuF DirBuster

Authorization Frameworks:

Spring Security Apache Shiro Casbin Passport.js Django Auth Pundit

How to Test:

Create accounts with different roles (user, admin)
Try accessing admin endpoints as regular user
Change HTTP methods (GET → DELETE, POST → PUT)
Fuzz for hidden admin endpoints
Test role parameter manipulation
Check API documentation vs actual access

🌍 Real-World Breaches

Instagram (2019): API allowed regular users to delete any comment
Uber (2016): Drivers could access admin functions via undocumented endpoints
Yahoo (2012): API vulnerability allowed unauthorized profile edits
Twitter (2020): Admin API accessible without proper role verification
E-commerce Platforms: Regular users accessing inventory management APIs

📌 Quick Tips

DO NOT rely on client-side role checks
DO NOT hide endpoints without authorization
DO NOT trust role parameters from requests
DO verify roles on every sensitive endpoint
DO use server-side authorization middleware
DO implement principle of least privilege
DO log and monitor privilege escalation attempts

📜 Compliance

Related Standards:

PCI-DSS Requirement 7.1 - Limit Access
SOC 2 CC6.1, CC6.3
ISO 27001 A.9.2.3
NIST 800-53 AC-3, AC-6
GDPR Art. 32
HIPAA §164.312(a)(4)

🛡️ Broken Function Level Authorization (BFLA)