PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The $30,000 Gem: Part 1

hackerone.com | blog | #access-control | #api-security | #graphql | #hackerone | #authorization | #secure-design
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne explains how it designed a permission layer between GraphQL and its database so queries only ever return data the requester is allowed to access; covers relationship-based access control and the Protected Attribute concept.
Published
Collected

Related coverage

blog · bishopfox.com
Design Considerations for Secure GraphQL APIs
Jake Miller covers security risks in GraphQL deployments and migrations, including authorization flaws and SSRF in GraphQL-to-REST interoperability, plus baseline hardening controls.
blog · wiz.io
The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2 of the Red Agent POV series: an autonomous BOLA exploit against an airline's GraphQL booking API used sequential IDs to read two years of passenger records and even modify live bookings.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
blog · labs.cognisys.group
The Golden Role How a Simple API Logic Flaw Unlocked an Entire SaaS Platform
In a true black-box assessment, the engagement begins with minimal information: a target URL and no prior knowledge of the application’s architecture, credentials, or codebase. During a recent engagement targeting a multi-tenant SaaS platform, our initial objective was to establish initial access through standard user provisioning.
blog · netspi.com
Detecting Authorization Flaws in Java Spring via Source Code Review (SCR)
Broken access control often slips past dynamic testing. This article shows how secure code review of Spring annotations, expressions, and filters surfaces Java Spring privilege escalation paths early.
blog · samcurry.net
Hacking Starbucks and Accessing Nearly 100 Million Customer Records
A Starbucks gift-card purchase tipped Sam Curry to suspicious /bff/proxy/ API calls; probing the backend-for-frontend routing ultimately exposed nearly 100 million customer records.
Back