API3:2023 — Broken Object Property Level Authorization

Slide 26 · The Matrix

Which mitigations stop which attacks?

Real incidents mapped to the defenses that would have stopped them.

BREACH — GitHub (2012) · Admin access · Mass Assignment

One extra parameter associated a key with another organization

Rails' auto-binding wrote user_id from the incoming request. One unguarded field = admin write access to any public repository on GitHub.

Stopped by: MIT 01 (allowlist: only permit "key" field on this endpoint) + MIT 02 (use params.permit() not auto-bind) + MIT 04 (user_id is a server-side-only field — never settable by client input)

BREACH — Peloton (2021) · 4M+ users · Excessive Data Exposure

Private accounts returned age, weight, city, birthday, workout stats via API

The app's privacy setting controlled the UI display. The API returned the full user object regardless of privacy status.

Stopped by: MIT 03 (DTO: define UserPublicResponse with only public fields) + MIT 05 (minimize: the "view profile" endpoint should not return weight or birthday) + MIT 07 (enforce at the API layer — not the app)

OWASP — Marketplace Price Manipulation · Financial damage · Mass Assignment

Host added total_stay_price to the approval request body

The approval endpoint accepted all fields. A host modified the guest's total price by adding one field to the request body.

Stopped by: MIT 01 (allowlist: approval endpoint only accepts "status") + MIT 04 (total_stay_price is platform-calculated — server-side only, never user-settable) + MIT 06 (schema validation on input would have rejected the extra field)

OWASP — Content Moderation Bypass · Platform integrity · Mass Assignment

User set blocked=false on their own flagged video

The video update endpoint accepted the "blocked" field. A user reversed their own moderation action in one request.

Stopped by: MIT 01 (allowlist: video update only accepts title, description, tags) + MIT 04 (blocked, flagged, under_review are admin-only fields — never in the user-facing update schema)

← Back Ready to test yourself? →