API Execution-Path Analysis for BOLA Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software applications are vulnerable to Broken Object Level Authorization (BOLA) attacks due to insufficient verification of user authorization, allowing malicious users to access and manipulate user information or resources they are not authorized to access.
Innovation Solution
A method and apparatus for identifying BOLA vulnerabilities by analyzing API endpoints, simulating attacks through execution paths, and issuing alerts when successful, using a large language model classifier and shell scripts to detect and exploit potential vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the application provides access to data objects based on user role without verification, then ease of operation is improved, but security reliability deteriorates
Solution Approach 1:
The system performs preliminary authorization verification by analyzing API execution paths and generating test scripts before actual attacks can occur. The vulnerability detection system proactively identifies BOLA vulnerabilities by simulating attack scenarios, allowing security issues to be detected and fixed before they can be exploited in production.
Solution Approach 2:
The invention introduces an intermediary vulnerability detection system that sits between the application and potential attackers. This system includes a vulnerability detector that analyzes API specifications, identifies execution paths, and generates test scripts to verify authorization logic, acting as a mediator that prevents unauthorized access without affecting legitimate user operations.
2Device complexity
If the application uses simple user ID-based authorization, then device complexity is reduced, but security reliability deteriorates
Solution Approach 1:
The vulnerability detection system performs self-service by automatically analyzing API specifications, identifying execution paths, generating test scripts, and executing vulnerability tests without requiring manual security audits. The system autonomously detects BOLA vulnerabilities by simulating attack scenarios and analyzing application responses.
Solution Approach 2:
The invention replaces manual security testing and code review mechanisms with an automated vulnerability detection system. The system uses computational analysis to examine API specifications, trace execution paths, and simulate attacks, substituting mechanical human analysis with automated computational processes that are more thorough and consistent.
3Productivity
If the application allows direct manipulation of user information, then productivity is improved, but security reliability deteriorates
Solution Approach 1:
The vulnerability detection system implements feedback by analyzing the responses received during simulated attacks. When test scripts attempt to exploit BOLA vulnerabilities by manipulating user information, the system examines the responses to determine whether the attack succeeded, providing feedback that identifies authorization gaps and allows for corrective actions.
Data Source
AI summary
Methods, storage systems and computer program products implement embodiments of the present invention for identifying a vulnerability in a software application. In these embodiments, a specification is received that includes a plurality of application programming interface (API) endpoints in the software application, and a first API endpoint of the software application that exposes user information is identified. An execution path in the software application is identified that includes an ordered sequence of two or more of the API endpoints, the ordered sequence starting with a second API endpoint and ending with the first API endpoint. An attack on the software application that exploits the identified execution path is simulated, and finally, an alert is issued when the simulated attack is found to have been successful.