API penetration testing (REST & GraphQL)

Description

The shop API returns an order to anyone who is logged in, without checking that the order belongs to them. Order numbers count up one by one, so a customer who changes their own number to the next one sees a stranger’s name, address and purchases. The same request also lets them change that stranger’s delivery address.

Steps to reproduce

1. Log in to the shop as test customer A and open one of your orders.
2. In the request the app sends, replace your order number with a number that belongs to test customer B.
3. The API returns customer B’s full order instead of an error.

GET /v2/orders/100482 HTTP/2
Host: api.admin-soehne.example
Authorization: Bearer <token of customer A>

HTTP/2 200
{"id":100482,"customer":"<customer B>","address":"…"}

Business impact

Anyone who creates a free customer account can read every order ever placed, one after another, and redirect parcels to another address. That is a GDPR data breach, reportable within 72 hours, and a direct path to parcel theft.

Remediation

On the server, check on every request that the logged-in customer owns the order they ask for, and answer “not found” otherwise. Use the same check for every object the API returns (invoices, addresses, returns). Add automated tests that try to read another customer’s data with a second test account.