Broken Function Level Authorisation

Broken Function Level Authorization (BFLA) is a critical security vulnerability where applications verify user identity (authentication) but fail to validate what actions they're permitted to perform (authorization). This oversight allows attackers with low-level privileges to bypass security controls and execute sensitive operations, potentially compromising entire systems. BFLA is particularly common in modern web applications and REST APIs where function-level permission checks are either overlooked or improperly implemented.

---

Key Characteristics

• Privilege Escalation: Enables low-privilege users to perform administrative actions
• Missing Validation: Systems authenticate users but don't verify permissions before executing functions
• API Vulnerability: Especially prevalent in REST APIs with weak backend authorization
• Stealthy Exploitation: Successful attacks often leave no obvious traces
• IDOR Connection: Frequently occurs alongside Insecure Direct Object Reference vulnerabilities

---

How the Vulnerability Works

Attack Mechanics

Attackers systematically exploit weak authorization through:

1. Discovery Phase: Identify administrative endpoints via:

   • Directory brute-forcing
   • API documentation analysis
   • Traffic interception
   • Predictable URL patterns (e.g., /admin/*)

2. Request Manipulation: Modify HTTP requests by:

   • Altering URL parameters
   • Changing HTTP methods (GET → POST)
   • Modifying object references
   • Adding/removing headers

3. Control Bypass: Circumvent client-side restrictions that aren't server-enforced

4. Privileged Execution: Perform unauthorized operations like:

   • Data access/modification
   • Account management
   • System configuration changes

Root Causes

The vulnerability emerges when applications:

Critical Flaw: Assume authentication equals authorization

• Skip permission validation after authentication
• Rely on "security through obscurity" for sensitive functions
• Use predictable endpoint naming conventions
• Implement authorization checks only on the client side
• Fail to validate user roles before executing operations

---

Real-World Attack Scenario

Vulnerable E-Commerce Platform

API Endpoint Structure:

Role	Endpoint	Intended Access
Customer	GET /api/user/orders	View personal orders
Admin	GET /api/admin/orders	View all customer orders
Admin	DELETE /api/admin/user/{id}	Delete user accounts

Exploitation Example:

Normal Request (Customer):
GET /api/user/profile?id=12345
Authorization: Bearer <customer_token>

Malicious Request (Same Customer):
GET /api/admin/orders
Authorization: Bearer <customer_token>

Impact Without Protection:

• View all customer payment details
• Delete arbitrary user accounts
• Modify product pricing
• Access business analytics
• Escalate personal privileges

---

Prevention Strategies

Core Protection Principles

Golden Rule: Never trust client-side controls - enforce all authorization server-side

1. Role-Based Access Control (RBAC):

   • Implement granular role-permission systems
   • Use role hierarchies (e.g., Admin > Manager > User)
   • Regularly audit role assignments

2. Request Validation:

   • Verify both authentication AND authorization for every request
   • Implement deny-by-default policies
   • Centralize authorization logic

3. Secure Patterns:

   • Avoid predictable endpoint naming
   • Use UUIDs instead of sequential IDs
   • Implement rate limiting on sensitive endpoints

Code Implementation Examples

Vulnerable Implementation:

// Only checks authentication
if (user.isAuthenticated()) {
    executeAdminFunction();
}

Secure Implementation:

// Validates both authentication and authorization
if (user.isAuthenticated() && user.hasRole('ADMIN')) {
    executeAdminFunction();
} else {
    throw new UnauthorizedException('Access denied');
}

Framework-Level Protection:

# Django decorator example
@permission_required('admin.delete_user')
def delete_user(request, user_id):
    # Only executes with proper permissions
    User.objects.filter(id=user_id).delete()

---

Detection and Testing

Security Testing Methods

1. Manual Testing:

   • Attempt to access admin endpoints with low-privilege accounts
   • Test all endpoints with each user role
   • Verify proper error responses

2. Automated Scanning:

   • Use Burp Suite's Autorize extension
   • Configure OWASP ZAP for authorization testing
   • Implement Postman collections with varied roles

3. Negative Testing:

   • Verify unauthorized access attempts are blocked
   • Test with missing/invalid authorization headers
   • Check for proper logging of failed attempts

Monitoring Indicators

Suspicious Activity Patterns:

• Non-admin users accessing admin endpoints
• Unusual spikes in sensitive function calls
• Access to undocumented endpoints
• Multiple failed attempts followed by success
• Unusual time-of-day access patterns

Critical Logging Requirements:

[SECURITY] User 4567 (role: USER) accessed /api/admin/settings
[ALERT] Privilege escalation attempt from IP 203.0.113.45
[VIOLATION] Unauthorized DELETE /api/admin/user/7890

---

Business Impact

Organizations suffering BFLA attacks experience:

• Data Breaches: Exposure of sensitive customer and business data
• Financial Fraud: Unauthorized transactions and pricing manipulation
• Compliance Violations: GDPR, HIPAA, and PCI-DSS non-compliance
• Operational Disruption: System misconfigurations and service outages
• Reputational Damage: Loss of customer trust and brand value
• Legal Consequences: Regulatory fines and litigation costs

Case Study: In 2021, a major e-commerce platform suffered a BFLA attack where attackers accessed admin endpoints to:

• View 5 million customer records
• Modify product prices
• Issue fraudulent refunds
• Resulting in $12M in losses and a 30% stock price drop

---

Secure Development Checklist

• Implement server-side authorization for all sensitive functions
• Use deny-by-default access control policies
• Centralize authorization logic in middleware
• Avoid predictable endpoint naming patterns
• Implement role-based access control (RBAC)
• Test all endpoints with each user role
• Log all access attempts to sensitive functions
• Regularly audit user permissions
• Use UUIDs instead of sequential IDs
• Implement rate limiting on admin endpoints

---

Learn More

Industry Standards

• OWASP Top 10: Broken Access Control (A01:2021)
• OWASP API Security Top 10: API5:2023 - Broken Function Level Authorization
• CWE-285: Improper Authorization
• NIST SP 800-53: Access Control (AC) family

Recommended Resources

• OWASP Testing Guide: Authorization testing methodologies
• OWASP ASVS: Access control requirements (V4)
• API Security Best Practices: REST API authorization patterns
• PortSwigger Web Security Academy: BFLA labs and tutorials
• NIST Guidelines: Access control implementation

Tools for Testing

Tool	Purpose	Key Feature
Burp Suite	Manual testing	Autorize extension
OWASP ZAP	Automated scanning	Authorization testing rules
Postman	API testing	Role-based collection testing
SQLMap	Vulnerability detection	Authorization bypass testing
Nuclei	Template-based scanning	BFLA detection templates