Cross-Tenant Object Authorization Verification and Contract Synthesis
A user changes an invoice number in the address bar from 1001 to 1002 and sees another customer's record because the server checked login status without checking record ownership. The verifier tests ownership isolation between two synthetic test accounts and generates an object-binding contract.
Broken object level authorization occurs when an endpoint authenticates the caller token yet fails to verify that the authenticated subject owns the requested record identifier. In multi-tenant interfaces, sequential numeric identifiers or predictable object keys expose every tenant record to horizontal enumeration.
1. Interception and Rule Synthesis Schematic for AUTH-BOLA
Verification sequence for AUTH-BOLA: candidate probe inspection by wire rule SEC-ZD-AUTH-01, differential confirmation via witness e3ff9c8cdc04a3d1, and compilation of gateway contract IMMUNE-BOLA-E3FF9C8C.
2. In-Path Mutation Blocking and Paired Decoy Verification (AUTH-BOLA)
Under rule SEC-ZD-AUTH-01, the wire filter restricts authorization probes to synthetic test principals and read-only methods. State-changing methods such as record deletion, balance transfer, or role modification are blocked before leaving the test runner.
The verifier executes a differential cross-subject check: it requests synthetic object 1002 using the session context of synthetic user 1001 and compares the response against an ownership-enforced decoy route. Across four benchmark cases, the engine records two true positives and two true negatives with zero false alarms.
Class Identifier: AUTH-BOLA (idor_bola)
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: GET /api/v1/vuln/bola/invoice/1002 (Header: X-Tenant-User: user_1001)
Blocked Mutation: DELETE /api/v1/vuln/bola/invoice/1002; PATCH /api/v1/accounts/role
Stand Confusion Matrix: TP = 2, FP = 0, TN = 2, FN = 0 (FPR = 0.0%)
Wire Sandbox Rule: SEC-ZD-AUTH-01
Formal Witness Hash: e3ff9c8cdc04a3d1
Compiled Sentinel Rule: IMMUNE-BOLA-E3FF9C8C (synthesis time 20 µs)3. Automatic Synthesis of Gateway Rule IMMUNE-BOLA-E3FF9C8C
Witness e3ff9c8cdc04a3d1 triggers compilation of rule IMMUNE-BOLA-E3FF9C8C in 20 microseconds. The contract enforces strict equality between the subject claim in the session header and the owner attribute of the requested resource.
4. Related Benchmark Classes on the INDRA Stand
INJ-SQL: Database Query InjectionINJ-CMD: Operating System Command InjectionDIR-TRV: Filesystem Path TraversalSSRF-INT: Server-Side Request Forgery and Redirect BypassSEC-LEAK: Authentication Token and Secret ExposureHDR-SEC: Missing Transport and Framing Security HeadersDOS-RSRC: Computational Resource Exhaustion (Isolated Lab Mode)