📋 Overview
Broken Function Level Authorization is a critical vulnerability in the OWASP API Security Top 10. This vulnerability occurs when an API fails to properly enforce authorization checks on sensitive administrative functions, allowing unauthorized users to access privileged operations.
⚠️ Key Concept
The Human Predictability Factor: Humans are predictable in their naming conventions and organizational patterns. Attackers exploit this predictability to discover hidden or administrative endpoints that should not be publicly accessible.
🎯 Understanding the Vulnerability
This vulnerability is essentially Broken Access Control in API flavor. The key issue is that endpoints that should require administrative privileges are accessible to regular users or are easily discoverable through predictable patterns.
Attack Flow Diagram
Identify API endpoints
Guess hidden endpoints
Access admin functions
Execute unauthorized actions
🔍 Practical Example Walkthrough
Scenario: Discovering Hidden Admin Endpoints
Starting Point: The API documentation reveals a public books endpoint, but also hints at the existence of administrative functions.
This endpoint is publicly accessible and returns a list of all books.
The documentation hints at administrative functions but doesn't provide complete details.
These are common patterns attackers try, but they may not always work.
Result: Returns a "Bad Request" error instead of "403 Unauthorized"
Critical Finding: The endpoint returns "400 Bad Request" instead of "403 Forbidden". This indicates the endpoint exists and is accessible, but requires different parameters or request method.
Switching from GET to POST request, as the error suggests incorrect request type.
Attempt various parameter combinations to discover valid admin operations.
🛠️ Common Attack Vectors
Version Guessing
Trying different API versions:
Path Variations
Testing different path structures:
HTTP Method Testing
Trying various HTTP methods:
Parameter Brute-forcing
Discovering valid parameters:
🎓 Advanced Testing Commands
Basic Endpoint Discovery
Use verbose mode to see detailed response headers and status codes.
Testing with Different HTTP Methods
Parameter Fuzzing
Authentication Bypass Testing
Using Automated Tools
🔐 Security Best Practices
For API Developers
- Implement Proper Authorization: Always verify user permissions before granting access to sensitive functions
- Return Consistent Error Messages: Use "403 Forbidden" for unauthorized access, not "400 Bad Request"
- Avoid Predictable Patterns: Don't use obvious naming conventions like /admin, /v3/admin
- Use Role-Based Access Control (RBAC): Implement granular permission systems
- Log Access Attempts: Monitor and alert on suspicious access patterns
Red Flags to Watch For
- Endpoints returning "400 Bad Request" instead of "403 Forbidden" for unauthorized access
- Predictable admin endpoint patterns (/admin, /v2/admin, etc.)
- Lack of authentication checks on sensitive operations
- Inconsistent authorization across different API versions
- Administrative functions accessible via simple parameter changes
📊 Vulnerability Impact Assessment
Severity Breakdown
🔴 High Risk
Unauthorized Admin Access
Full system compromise possible
🟠 Medium Risk
Data Exposure
Sensitive information leakage
🟡 Low Risk
Information Disclosure
API structure revelation
💡 Key Takeaways
- Broken Function Level Authorization is essentially broken access control in API implementations
- Human predictability in naming conventions makes admin endpoints discoverable
- A "400 Bad Request" response instead of "403 Forbidden" indicates improper authorization handling
- Attackers exploit version numbering and predictable paths to discover hidden endpoints
- Proper authorization checks must be implemented at every sensitive endpoint
- Testing requires systematic enumeration of endpoints, HTTP methods, and parameters
🔗 Related OWASP API Security Risks
This vulnerability (A5) is closely related to:
- A1: Broken Object Level Authorization - Similar concept but at the object level
- A3: Excessive Data Exposure - Can result from poor authorization
- A7: Security Misconfiguration - Often the root cause of authorization issues