Broken Object Property Level Authorization (BOPLA / Mass Assignment)

Table of Contents

1. Challenge

   Implement a REST controller that exhibits the BOPLA vulnerability

   In this objective, you will examine a vulnerable Spring Boot API and demonstrate how a Broken Object Property Level Authorization (BOPLA) vulnerability caused by Mass Assignment can be exploited. Using a standard user account, you will modify a protected property to simulate an unauthorized privilege escalation. This exercise establishes the foundation for implementing and validating a secure remediation in the following objectives.

2. Challenge

   Implement a BOPLA fix

   Now that you have demonstrated the vulnerability, it is time to implement a secure solution. In this objective, you will refactor the application to prevent Mass Assignment by introducing Data Transfer Objects (DTOs), updating the vulnerable endpoint to use the new request model, and rebuilding the project. You will then rerun the exploit to verify that the vulnerability has been remediated before implementing a dedicated administrative endpoint for authorized updates.

3. Challenge

   The mystery of updating sensitive fields correctly

   With the standard user profile endpoint securely locked down using DTOs, the final stage is to implement a dedicated administrative pathway for modifying sensitive properties. In this objective, you will review how the application handles privileged operations using explicit role-based access controls and execute validation tests to confirm that the defense-in-depth architecture functions flawlessly.