---
description: 10 November 2024
---

# Mitigating Broken Object Level Authorization (BOLA)

## **What is BOLA?**

**Broken Object Level Authorization (BOLA)** occurs when an application fails to properly verify that a user has the necessary permissions to access a specific object or resource. This vulnerability can lead to unauthorized access, data breaches, and other security issues.

## **How BOLA Maps to OWASP Top 10**

BOLA is categorized under **A01:2021 - Broken Access Control** in the OWASP Top 10. Broken Access Control is considered the most critical web application security risk, as it affects many applications and can lead to severe consequences like data theft and unauthorized data modification.

## **How the Attacker Exploits BOLA**

An attacker could exploit this vulnerability by obtaining or guessing a valid token and then using it to access another user's profile, bypassing any authorization checks.

### **Attack Scenario**

Imagine a company that provides a web application allowing users to access their profiles through an API. Each user has a unique profile with personal information, and the API uses tokens for authentication and authorization.

### **Insecure Implementation (Prone to BOLA) Using Java Spring Security**

In this insecure implementation, the API does not properly verify that the authenticated user has permission to access the requested user's profile.

```java
@RestController
@RequestMapping("/api")
public class UserController {

    private final UserRepository userRepository;

    public UserController(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @GetMapping("/profile")
    public ResponseEntity<?> getProfile(@RequestHeader("Authorization") String token) {
        User currentUser = getUserByToken(token);

        if (currentUser == null) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized");
        }

        // No additional authorization check
        return ResponseEntity.ok(currentUser);
    }

    private User getUserByToken(String token) {
        // Mock function to get user by token
        if ("token1".equals(token)) {
            return new User(1L, "Alice", "alice@example.com");
        } else if ("token2".equals(token)) {
            return new User(2L, "Bob", "bob@example.com");
        }
        return null;
    }
}
```

**Attack Payload Example**:

```sh
curl -H "Authorization: token2" http://localhost:8080/api/profile
```

In this case, an attacker using a stolen or guessed `token2` accesses Bob's profile.

### **Secure Implementation (BOLA Mitigated) Using Java Spring Security**

In the secure implementation, the API ensures that the token provided matches the user's identity, verifying that the token is valid for the requesting user and implementing access controls at the database query level.

```java
@RestController
@RequestMapping("/api")
public class UserController {

    private final UserRepository userRepository;

    public UserController(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @GetMapping("/profile")
    public ResponseEntity<?> getProfile(@RequestHeader("Authorization") String token) {
        User currentUser = getUserByToken(token);

        if (currentUser == null) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized");
        }

        // Additional authorization check to ensure the token is valid for the requesting user
        if (!isTokenValidForUser(token, currentUser.getId())) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("Forbidden");
        }

        // Implement access controls at database query level
        User user = userRepository.findById(currentUser.getId()).orElse(null);
        if (user == null) {
            return ResponseEntity.status(HttpStatus.NOT_FOUND).body("User not found");
        }

        return ResponseEntity.ok(user);
    }

    private User getUserByToken(String token) {
        // Mock function to get user by token
        if ("token1".equals(token)) {
            return new User(1L, "Alice", "alice@example.com");
        } else if ("token2".equals(token)) {
            return new User(2L, "Bob", "bob@example.com");
        }
        return null;
    }

    private boolean isTokenValidForUser(String token, Long userId) {
        // Add logic to verify that the token is valid for the user ID
        return ("token1".equals(token) && 1L.equals(userId)) || ("token2".equals(token) && 2L.equals(userId));
    }
}
```

The secure implementation ensures that the token provided matches the user's identity, verifying that the token is valid for the requesting user. It also implements access controls at the database query level to protect Personally Identifiable Information (PII).

### **Key Points for Developers**

* **Always** verify that a user has the necessary permissions to access specific resources.
* **Validate API tokens** to ensure they are not compromised and are correctly assigned to the requesting user.
* **Implement access controls at the database query level** to protect sensitive information, especially Personally Identifiable Information (PII).
* **Use secure coding practices** such as input validation, prepared statements, and encryption to prevent vulnerabilities.

## **Conculsion**&#x20;

BOLA vulnerabilities occur when applications fail to enforce proper authorization checks, leading to unauthorized access to sensitive data. This vulnerability maps to **A01:2021 - Broken Access Control** in the OWASP Top 10. Ensuring that authorization checks are performed at the object level is crucial for mitigating this risk. By following secure coding practices, validating API tokens, and implementing access controls at the database query level, developers can build more secure applications and reduce the risk of security breaches.

Here are some useful references for more details on Broken Object Level Authorization (BOLA):

1. **OWASP API Security Top 10 - Broken Object Level Authorization (BOLA)**: [OWASP API Security Top 10](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/)
2. **Sec-Notes on Broken Object Level Authorization (BOLA)**: [Sec-Notes](https://ahmed-tarek.gitbook.io/sec-notes/api-pen/api-authorization-attacks/broken-object-level-authorization-bola)
3. **Heimdal Security on BOLA**: [Heimdal Security](https://heimdalsecurity.com/blog/what-is-broken-object-level-authorization-bola/)
4. **Imperva on BOLA**: [Imperva](https://www.imperva.com/learn/application-security/broken-object-level-authorization-bola/)
