sc-authz

SC: Authorization Flaws (IDOR / Broken Access Control)

Purpose

Detects authorization vulnerabilities where authenticated users can access resources belonging to other users (IDOR/horizontal escalation), access admin functions without proper role checks (vertical escalation), or bypass access control through parameter manipulation. Traces from route handler to data access to verify that ownership or role checks are enforced.

Activation

Called by sc-orchestrator during Phase 2. Runs against all web applications and APIs.

Phase 1: Discovery

File Patterns to Search

**/*controller*, **/*handler*, **/*route*, **/*endpoint*,
**/*service*, **/*repository*, **/*middleware*, **/*guard*,
**/*policy*, **/*permission*, **/*role*, **/*authorization*

Keyword Patterns to Search

# Direct object references
"params.id", "params.userId", "req.params", "request.args",
"$_GET['id']", "PathVariable", "[FromRoute]",
"r.URL.Query().Get(", "mux.Vars("

# Data access without ownership check
"findById(", "findByPk(", "findOne({id:", "get_object_or_404(",
"User.find(", ".where(id:", "GetById(", "Find(&"

# Missing role checks
"isAdmin", "role ==", "hasRole(", "hasPermission(",
"@PreAuthorize", "@Secured", "[Authorize(",
"@login_required", "@permission_required"

IDOR Detection Pattern

Trace from HTTP route parameter to database query and check if user ownership is verified:

// VULNERABLE: No ownership check — any authenticated user can access any order
app.get('/api/orders/:id', auth, async (req, res) => {
  const order = await Order.findById(req.params.id);
  res.json(order);
});

// SAFE: Ownership check ensures user can only access their own orders
app.get('/api/orders/:id', auth, async (req, res) => {
  const order = await Order.findOne({
    _id: req.params.id,
    userId: req.user.id  // Ownership check
  });
  if (!order) return res.status(404).json({ error: 'Not found' });
  res.json(order);
});

# VULNERABLE: Django view without ownership check
def order_detail(request, order_id):
    order = get_object_or_404(Order, pk=order_id)
    return JsonResponse(model_to_dict(order))

# SAFE: Filter by user
def order_detail(request, order_id):
    order = get_object_or_404(Order, pk=order_id, user=request.user)
    return JsonResponse(model_to_dict(order))