API BOPLA, Broken Object Property Level Authorization (OWASP API3)

Purpose

Test whether API responses expose restricted properties to unauthorized callers (READ) and whether unauthorized callers can modify properties they should not control (WRITE/mass assignment).

Preconditions

• At least one valid account/session (for differential testing)
• Known API endpoints that return or accept object properties
• The authz_matrix tool available for cross-role comparison

Attack Surface Signals

• API responses containing fields beyond what the UI displays
• Endpoints that accept JSON/XML bodies with multiple properties
• PATCH/PUT endpoints that update object fields
• OpenAPI specs listing restricted fields
• Different response shapes for different roles

Methodology

Unauthorized Property READ (Excessive Data Exposure)

Establish what the caller SHOULD see, then verify what they ACTUALLY receive:

# 1. Get the legitimate response for the lowest-privilege caller
curl -sk -H "Authorization: Bearer USER_TOKEN" "https://TARGET/api/users/me" | jq . > tmp/user_response.json

# 2. Check for restricted properties in the response
# Look for: role, isAdmin, internalId, permissions, balance, tenantId,
# is_verified, price_override, created_by, deleted_at, api_key, password_hash
jq 'keys' tmp/user_response.json

# 3. Compare against the same endpoint as a higher-privilege caller
# (if available) or against the UI display
curl -sk -H "Authorization: Bearer ADMIN_TOKEN" "https://TARGET/api/users/me" | jq . > tmp/admin_response.json
diff <(jq -S 'keys' tmp/user_response.json) <(jq -S 'keys' tmp/admin_response.json)

IMPORTANT: Field NAMES alone are not evidence. Verify the VALUE is:

• Genuinely sensitive (PII, credentials, internal flags, financial data)
• Not accessible to the caller through any intended UI
• Returned in a context where the caller should not see it

Unauthorized Property WRITE (Mass Assignment)