Client
Digital bank
Service
Web & API penetration test
Location
Undisclosed
A digital bank asked us to test the customer application and the APIs behind it. One endpoint served account statements. It checked that the caller was logged in. It never checked that the statement belonged to them.
The Challenge
Broken object level authorization is the most ordinary critical there is, and the most common. The session was valid, the token was valid, the request was well formed, and the object identifier in the path was trusted.
Every check the platform performed was a check on identity. None of them was a check on ownership. Statements are not a minor object: they carry names, balances, transaction history and counterparties. Anything reachable this way is reachable at scale, because the identifier is guessable and the endpoint is fast.
The Approach
We mapped the API surface first, then separated the endpoints that accept an object identifier from the ones that do not. Two accounts under our control, one request replayed across both, and the mismatch was immediate.
The finding was in the client channel the hour it was confirmed, with the request, the response and the reasoning attached. We then walked the rest of the surface for the same pattern, because authorization bugs travel in families.
The Outcome
The endpoint was fixed with an ownership check at the object level, and the same check was applied across the sibling endpoints we flagged.
We retested after the fix shipped and confirmed the path was closed. Reported as CRITICAL in 2024. Retest included in the engagement.
Case Studies
