Horizontal Privilege Escalation via Broken Object Level Authorization (BOLA)

Broken Object Level Authorization (BOLA) enables cross-user document viewing, modification, and unauthorized deletion via direct object reference.

GHSA References

• GHSA-gj3h-wcpc-5pw7 https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-gj3h-wcpc-5pw7

• GHSA-m56q-pj22-83xq https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-m56q-pj22-83xq

---

Summary

The application fails to enforce proper object-level authorization when resolving documents using direct object references:

/documents/{documentId}

An authenticated user can:

• View documents belonging to other users
• Modify document content in real time
• Perform collaborative edits
• Permanently delete documents via the REST API

This results in horizontal privilege escalation across users.

Affected versions: All (main branch) Severity: High

---

Vulnerability 1 — Unauthorized Viewing & Modification

(GHSA-gj3h-wcpc-5pw7)

Documents are assigned explicit owner-bound permissions:

"$permissions": [
  "read(\"user:OWNER_ID\")",
  "update(\"user:OWNER_ID\")",
  "delete(\"user:OWNER_ID\")"
]

Despite these restrictions:

• Authenticated User B navigates to:

  /documents/{DocumentID}
  

• Document loads successfully

• Live editing is enabled

• Changes persist and sync in real time

Delete operations are restricted, but update operations are not properly validated.

This confirms update-level authorization bypass.

---

🔥 PoC — Unauthorized View & Modify

Steps to Reproduce

1. Register Account A
2. Create a document
3. Copy the Document ID
4. Register Account B
5. Login as Account B
6. Navigate to:

https://realtime-collaboration-platform-steel.vercel.app/documents/{DocumentID}

Result

• Document loads
• Editing is permitted
• Changes are reflected in real time
• Owner sees modified content

Impact: Confidentiality + Integrity compromise

---

Vulnerability 2 — Unauthorized Deletion

(GHSA-m56q-pj22-83xq)

Deletion permissions are defined at metadata level but not enforced at the API layer.

Endpoint:

DELETE /v1/databases/{databaseId}/collections/documents/documents/{documentId}

---

🔥 PoC — Unauthorized Deletion

fetch("https://cloud.appwrite.io/v1/databases/6981d87b002e1c8dbc0d/collections/documents/documents/69981f2500182f323cd2", {
  method: "DELETE",
  credentials: "include",
  headers: {
    "X-Appwrite-Project": "6981d34b0036b9515a07"
  }
});

Result

• HTTP 204 No Content
• Document permanently deleted
• Owner cannot recover it

Impact: Confidentiality + Integrity + Availability compromise

---

Why This Is Critical

This vulnerability:

• Enables horizontal privilege escalation
• Breaks object-level authorization
• Allows unauthorized state-changing operations
• Aligns with OWASP API Top 10 — API1: Broken Object Level Authorization
• Maps to MITRE CWE-639

---

Recommended Remediation

• Enforce strict server-side ownership validation
• Validate requesting user against permission set
• Implement backend-level authorization middleware
• Audit all state-changing endpoints
• Never rely on client-side routing for access control

---

⭐ Follow Me & Connect

🔗 GitHub: https://github.com/AdityaBhatt3010
💼 LinkedIn: https://www.linkedin.com/in/adityabhatt3010/
✍️ Medium: https://medium.com/@adityabhatt3010

---