From Frontend Recon to Critical API Flaws in Urban Mobility Platforms

Context & Scope#

During independent security research assessing a multi-tenant web application for an on-demand urban mobility and delivery service platform, I evaluated the application's role-based access control (RBAC) model. The platform serves two distinct user classes: standard field contractors (couriers and drivers managing their earnings and vehicle onboarding) and internal back-office operators (dispatchers, fleet coordinators, and system administrators).

The primary objective was to evaluate whether backend API boundaries strictly enforced privilege separation, or whether access control relied on frontend visibility and security through obscurity. The assessment was performed ethically and non-disruptively using low-privileged test accounts, verifying that sensitive cross-tenant and administrative resources remained isolated.

Tools & Setup#

• Burp Suite - intercepting authenticated HTTP and WebSocket streams, comparing role-based authorization differentials with Repeater, and automating header modifications.
• Claude Opus - assisting in deconstructing minified single-page application (SPA) router maps and identifying obscured administrative endpoint patterns.
• Browser DevTools & WebSocket Inspector - dissecting compiled client-side application bundles, inspecting network communication, and evaluating bidirectional WebSocket frame handlers.
• Postman & cURL - building parameterized test suites, testing authorization token boundaries, and generating clean proof-of-concept requests.

Technical Walkthrough#

1. Client-Side Reconnaissance & Route Dissection: Modern single-page applications frequently compile frontend routes into shared production bundles. Inspecting the application's compiled client-side bundles served to unauthenticated visitors revealed that role-based code splitting had not been implemented. The bundled router contained full definitions for administrative endpoints—including fleet directories, user registries, database synchronization triggers, and audit trails. Extracting these path patterns provided a comprehensive map of the platform's internal API surface.

2. Broken Function Level Authorization (BFLA): I registered a basic user account (with an unverified, inactive status) and extracted its standard Bearer session token from the browser. Moving to Postman, I replayed the token against the discovered administrative endpoints:

   • Global User & Fleet Registries: Querying the fleet overview endpoint (/api/v1/fleet/directory/all) returned all registered vehicles in the database (over 15,600 records). Simultaneously, calling contractor directory endpoints (/api/v1/directory/contractors and /api/v1/directory/contractors/search) dumped the complete contractor and customer database (over 36,000 records). The response payloads exposed highly sensitive personally identifiable information (PII): legal names, personal email addresses, phone numbers, account status, residential addresses, dates of birth, national identification numbers, passport and national identity card numbers, bank account numbers, and loyalty reward balances.
   • Administrative Staff Disclosure: Calling the administrative directory endpoint (/api/v1/staff/operators/directory) dumped the complete directory of internal back-office operators and administrators, exposing their full personal contact details, residential addresses, and private banking data.
   • Applicant PII Exposure via Synchronization Routes: An administrative synchronization endpoint (/api/v1/management/sync/contractors) failed to enforce role checks. Rather than performing an internal maintenance task silently, the endpoint returned cleartext records of candidates and contractors in the synchronization queue—including legal names, email addresses, phone numbers, national identification numbers, identity document numbers, birth dates, and registered educational institutions.
   • High-Risk Demographic Agreements Registries: Unprivileged requests to compliance endpoints (/api/v1/compliance/agreements/international and /api/v1/compliance/agreements/minor-consents) dumped sensitive contract archives:
     • The international agreement endpoint exposed passport details, national residency numbers, and residential history for all foreign contractors.
     • The minor agreement endpoint exposed personal records of under-aged contractors alongside direct references and attachments to parental consent declarations, exposing the personal data and physical signatures of parents and legal guardians.
   • Email Verification Bypass: A separate administrative support endpoint (POST /api/v1/account-lifecycle/verification/override) permitted forcing the verified status of any user account simply by supplying their user identifier, completely bypassing the email confirmation token workflow.
   • Permission Matrix Enumeration: Calling an internal IAM inspection route (/api/v1/iam/roles/inspect/{userId}) allowed inspecting the exact system privileges and role assignment matrix assigned to any internal or external account.

3. Insecure Direct Object References (IDOR) & File Upload Flaws: While global administrative listings were subsequently restricted, resource-specific endpoints accepting object identifiers remained vulnerable to direct parameter tampering:

   • Cross-Account Profile & Fleet Inspection: By substituting target user identifiers (easily harvestable from the initial directory leaks), low-privileged accounts could access private sub-resources:
     • /api/v1/fleet/assignments/{userId} - querying complete vehicle ownership and lease records.
     • /api/v1/compliance/residency/{userId} - retrieving foreign citizenship details, country of origin, and passport numbers.
     • /api/v1/rewards/ledger/{userId} - viewing private loyalty reward balances and transactional ledger histories.
     • /api/v1/finance/payouts/{userId} - accessing historical banking settlements and withdrawal orders.
   • Unrestricted Digital Signature Upload: During the onboarding flow, users submit a digital signature image. The handling endpoint (POST /api/v1/onboarding/signature/upload) accepted arbitrary MIME types and file extensions (including executable and script extensions such as .exe, .svg, and .html) without file size limitations or rate restrictions. The files were pushed directly into the platform's public cloud object storage container (storage.cloud-provider.local), creating immediate vectors for hosting malicious payloads, stored HTML phishing pages, or exhausting storage quotas.

4. WebSocket Role Verification Gap: Real-time communication channels frequently bypass standard HTTP middleware security filters. I established an authenticated WebSocket handshake (wss://api.target-platform.local/ws) using an unverified worker session token and dispatched administrative event queries. Sending an action payload designed for back-office dashboards (GET_ONLINE_ADMINS) did not merely return status indicators; it dumped full database records for all currently active administrative staff—including legal names, corporate and personal emails, phone numbers, national identification numbers, identity document numbers, personal bank accounts, residential addresses, assigned fleet vehicles, and employment agreements.

GET /api/v1/fleet/directory/all HTTP/1.1
Host: api.target-platform.local
Authorization: Bearer <unverified_user_token>
Accept: application/json

// WebSocket frame dispatched over wss://api.target-platform.local/ws
{
  "Authorization": "<unverified_user_token>",
  "action": "GET_ONLINE_ADMINS"
}

Findings & Severity#

Responsible Disclosure & Takeaways#

All findings were consolidated into a detailed security assessment report and submitted directly to the organization's technical leadership via responsible disclosure. Proofs of concept were constructed to be minimal and non-destructive, and no exposed customer or employee records were downloaded or retained. The organization verified the findings, applied centralized authorization middleware across all REST and WebSocket controllers, and introduced automated integration tests to validate role boundaries during their CI/CD pipelines.

From a security architecture standpoint, this engagement illustrates two critical concepts:

1. Authentication is not Authorization: A cryptographically valid JWT or session token confirms identity, not privilege. Verification must be coupled with strict, policy-based authorization middleware that validates role assignments prior to executing backend business logic.
2. Channel Parity in Access Control: Modern web stacks that combine REST APIs with asynchronous WebSockets must apply uniform security policies across all protocols. Implementing robust authorization on HTTP routes while neglecting WebSocket message dispatchers leaves internal state easily accessible.