bola-CVE-2023-27524

📄 README.md — BOLA CVE-2023-27524 Projet de démonstration

# 🔐 Broken Object Level Authorization (BOLA) Demonstration  
## CVE-2023-27524 Security Analysis & Fix

---

## 📌 Project Overview

This project demonstrates a real-world **Broken Object Level Authorization (BOLA)** vulnerability and its secure remediation using a Flask-based API.

The vulnerability is modeled after **CVE-2023-27524**, which involves improper authorization controls that allow attackers to access or manipulate unauthorized objects by modifying object identifiers (IDs) in API requests.

This repository includes:
- ❌ vulnerable_api.py: A vulnerable version of the API 
- ✅ fixed_vulnerable_api.py: A secure fixed version implementing proper object-level authorization

---

## ⚠️ What is BOLA?

**Broken Object Level Authorization (BOLA)** occurs when an application:
- Exposes object IDs (e.g., `/profile?id=2`)
- Fails to verify whether the authenticated user is authorized to access that object

### 🔴 Impact:
Attackers can:
- Access other users' private data
- Modify or delete unauthorized resources
- Perform horizontal privilege escalation

---

## 💥 Vulnerable Implementation

### Example (Vulnerable Code)

```python
@app.route('/profile')
def profile():
    user_id = request.args.get("id")
    return users.get(int(user_id))

❌ Problem:

No authentication check
No ownership validation
User-controlled ID directly accesses database objects

🔓 Exploit Scenario:

/profile?id=1   → Alice data
/profile?id=2   → Bob data (unauthorized access)

🔒 Fixed Secure Implementation

Example (Secure Code)

@app.route('/profile')
def profile():
    requested_id = int(request.args.get("id", session["user_id"]))

    # Object-level authorization check
    if requested_id != session["user_id"]:
        return "403 Forbidden - Access Denied", 403

    return users.get(requested_id)

✅ Security Fix Applied

This implementation prevents BOLA by enforcing:

✔ Session-based authentication ✔ Object ownership validation ✔ Server-side authorization checks ✔ Prevention of ID tampering attacks

🧠 Key Security Lesson

Never trust user-supplied object identifiers without verifying authorization on the server side.

Authentication is NOT enough — authorization must be enforced at the object level.

📊 Attack Flow vs Secure Flow

❌ Vulnerable Flow:

User → API Request (/profile?id=2) → Direct DB Access → Data Leak

✅ Secure Flow:

User → API Request → Session Check → Ownership Validation → Allowed/Denied

🧪 How to Run

1. Install dependencies

pip install flask

2. Run application

python fixed_vulnerable_api.py or vulnerable_api.py

3. Access app

http://127.0.0.1:5000

📁 Project Structure

api-bola-demo/
│
├── vulnerable_api.py     # insecure version
├── fixed_vulnerable_api.py   # Fixed BOLA version
└── README.md

bola-CVE-2023-27524

Populaires

bola-CVE-2023-27524

📄 README.md — BOLA CVE-2023-27524 Projet de démonstration

❌ Problem:

🔓 Exploit Scenario:

🔒 Fixed Secure Implementation

Example (Secure Code)

✅ Security Fix Applied

🧠 Key Security Lesson

📊 Attack Flow vs Secure Flow

❌ Vulnerable Flow:

✅ Secure Flow:

🧪 How to Run

1. Install dependencies

2. Run application

3. Access app

📁 Project Structure