Cross role, function or session authorization boundaries

Needs: The lower-role identity can invoke a protected server-side action without its required authorization

Replay the same operation as

# Replay the same operation as
anonymous -> ordinary user -> alternate ordinary user -> administrator

Shell commands

# Baseline
curl -ski -b user-a.cookies http://TARGET:PORT/admin/PATH
curl -ski -X POST -b user-a.cookies -H 'Content-Type: application/json' -d '{"action":"EXPECTED_ACTION"}' http://TARGET:PORT/api/admin/PATH

Failure cue: a route name containing admin does not establish a bypass. Verify a privileged read or action under the lower-privileged identity.

Verify → Prove the protected effect and requesting identity; a rendered administrative page without action rights is a weaker finding.

If it fails → Expired cookies, CSRF checks and wrong methods are request-state failures; preserve the valid baseline before assessing authorization. More detail ↓

If → then

API objects expose role, ownership or security-sensitive properties → Modify a protected property through excessive writable fields
Needs: The server binds an untrusted property to a persistent security-relevant field without checking permission
WordPress paths/components or an accepted application administrator credential → Use WordPress component evidence and authorized administration features
Needs: Exact component/version or a verified role; file-edit/plugin installation rights and runtime write/execution must be checked
A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Cross role, function or session authorization boundaries

USE WHEN: Administrative actions/routes or request methods visible from a lower role
STARTING ACCESS: A reproducible application request and a controlled input or access-context comparison
RESULT: A verified application privilege/action transition

Recognize the clue

Compare ordinary-user and authorized-administrator requests for a real protected function, preserving method, CSRF/session and arguments.

curl -sk -i -b lower-role.cookies http://TARGET:PORT/ADMIN_PATH

SYNTHETIC EXAMPLE OUTPUT

Lower-role request: protected management form visible
Protected action result: not yet tested

Means: A visible administrative route is a lead; only a server-side protected effect establishes the missing role check.

Confirm: Replay a valid authorized action under the lower context and independently inspect its permitted effect.

After validation: The lower context performs the protected action: select the function/role authorization method.
Ruled out in this context: Only the form is visible and every protected action is correctly denied: reject action-level compromise.
Still inconclusive: CSRF/session failure prevents assessing authorization; repair the normal request first.

Troubleshooting: Expired cookies, CSRF checks and wrong methods are request-state failures; preserve the valid baseline before assessing authorization.

Replay the same operation as:

Compare UI and API paths, then test the legitimate method variants suggested by captured traffic or documentation.

Failure cue: a route name containing admin does not establish a bypass. Verify a privileged read or action under the lower-privileged identity.

Why it works

Hiding a button is presentation control. Authorization must be enforced on the server for the exact route/method/action; authentication alone does not grant that action.

Worked example · hypothetical

Observation: a low-role account knows an administrative endpoint. Test: replay the authorized action with that account's valid session. Illustrative output: an independent read confirms the protected change. Interpretation: function authorization is missing.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗