Broken Object Level Authorization (BOLA), historically categorized as Insecure Direct Object References (IDOR), consistently ranks as the number one vulnerability in the OWASP API Security Top 10.
The Root Cause of BOLA#
In modern microservice architectures, developers frequently decouple authentication from data authorization:
◆
A gateway validates that the incoming request contains a valid JWT token.
◆
The request is forwarded to an internal backend service with parameters like
/api/v1/accounts/10842/statement.◆
The controller queries the database using
SELECT * FROM statements WHERE account_id = 10842 without verifying if the authenticated user has explicit ownership of account 10842.Technical Exploitation Pattern#
An attacker with a standard user account (user_id: 501) authenticates legitimately to receive a valid bearer token:
http
GET /api/v2/invoices/94021 HTTP/1.1
Host: api.enterprise-target.in
Authorization: Bearer eyJhbGciOiJIUzI1Ni...By cycling through incremental numeric or sequential GUIDs in an automated script (e.g. 94022, 94023), the attacker exfiltrates proprietary enterprise invoices, financial records, and confidential telemetry.
Remediation: Ownership Context Validation#
Always enforce authorization at the database layer or repository interface:
typescript
// Vulnerable Pattern:
const record = await db.invoices.findUnique({ where: { id: invoiceId } });
// Secure Pattern:
const record = await db.invoices.findFirst({
where: {
id: invoiceId,
organizationId: session.user.organizationId // Enforce tenant boundary
}
});DESCAM RESEARCH TEAM