access-control-audit

Access Control Audit (OWASP A05)

Detect and fix broken access control vulnerabilities including IDOR, privilege escalation, and missing authorization checks.

When to Use

• Implementing authorization logic
• Auditing API endpoint permissions
• Reviewing admin functionality
• Checking resource ownership
• Implementing role-based access
• Preventing privilege escalation

Common Vulnerabilities

Vulnerability	Risk	Example
IDOR	HIGH	/api/users/123 accessible by any user
Missing Auth Check	CRITICAL	Admin endpoints without verification
Privilege Escalation	CRITICAL	User can elevate to admin
Path Traversal	HIGH	../../admin/config
Forced Browsing	MEDIUM	Guessing admin URLs
Metadata Manipulation	HIGH	Changing userId in JWT

Detection Patterns

Missing Authorization Checks

// VULNERABLE - No ownership check
app.get('/api/documents/:id', async (req, res) => {
  const doc = await Document.findById(req.params.id);
  res.json(doc); // Anyone can access any document!
});

// VULNERABLE - No role check on admin route
app.delete('/api/users/:id', async (req, res) => {
  await User.findByIdAndDelete(req.params.id);
  res.json({ success: true }); // Any user can delete anyone!
});

// VULNERABLE - Client-side only checks
// Frontend hides admin button, but API has no check
if (user.role === 'admin') {
  showAdminButton();
}

IDOR (Insecure Direct Object Reference)

// VULNERABLE - Sequential IDs exposed
app.get('/api/invoices/:id', (req, res) => {
  // User can increment ID to see other invoices
  const invoice = await Invoice.findById(req.params.id);
  res.json(invoice);
});

// VULNERABLE - User ID from request body
app.post('/api/profile/update', (req, res) => {
  // Attacker can change userId to modify others
  await User.findByIdAndUpdate(req.body.userId, req.body.data);
});

Privilege Escalation

// VULNERABLE - Role from user input
app.post('/api/users', (req, res) => {
  const user = new User({
    email: req.body.email,
    role: req.body.role // Attacker sets role: 'admin'
  });
});

// VULNERABLE - Mass assignment
app.put('/api/profile', (req, res) => {
  // Attacker adds { isAdmin: true } to request
  await User.findByIdAndUpdate(userId, req.body);
});