使用 Anthropic-Cybersecurity-Skills 检测与测试 OWASP API3:2023 对象属性级授权缺陷（BOPLA）

使用 Anthropic-Cybersecurity-Skills 检测与测试 OWASP API3:2023 对象属性级授权缺陷BOPLA【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本指南以 skills/detecting-broken-object-property-level-authorization/SKILL.md 为核心系统讲解 Broken Object Property Level AuthorizationBOPLAOWASP API Security Top 10 2023 版 API3:2023的检测方法论、自动化测试工具与修复方案。读者将掌握如何通过 Excessive Data Exposure 与 Mass Assignment 两类缺陷模式识别 API 响应中过度暴露的敏感字段、请求体中可注入的越权属性并能直接运行仓库提供的扫描器对目标接口进行批量验证与告警输出。一、BOPLA 是什么对象级授权之外的第二道缺口BOPLABroken Object Property Level Authorization是 OWASP API Security Top 10 中 API3:2023 的分类它合并了两类紧密相关的漏洞家族缺陷类别核心描述Excessive Data Exposure过度数据暴露API 返回的响应属性超出客户端实际需要敏感字段虽然不在 UI 中展示却完整传输给了调用方Mass Assignment批量赋值API 不加过滤地把客户端提交的数据绑定到内部对象属性导致攻击者可写入本无权限修改的字段对应的 CWE 编号在 references/api-reference.md 中有明确归类CWE-213因策略不一致导致敏感信息暴露与CWE-915对动态确定的对象属性控制不当。BOPLA 的关键在于即使 API 正确地实现了对象级授权用户只能访问属于自己的对象它仍可能在属性级上失守——用户能读取对象上不该读的字段或写入对象上不该写的字段。攻击者正是利用这一差异从 API 响应中读取敏感属性或向请求体中注入额外属性来修改无权触碰的字段。在本仓库的 MITRE ATTCK 映射中见 SKILL.md 的 front matter该技能关联了T1190利用面向公网的应用程序漏洞、T1213从信息系统中收集数据与T1212利用工具/机制漏洞同时映射了 NIST CSF 2.0 的PR.PS-01 / ID.RA-01 / PR.DS-10 / DE.CM-01控制项说明它既可用于攻击面评估ID.RA-01也可指导安全监控覆盖的验证DE.CM-01。二、适用场景与前置条件适用场景安全事件调查中需要检测对象属性级授权缺陷时为这一领域编写检测规则或威胁狩猎查询时SOC 分析人员需要结构化分析流程时验证安全监控对相关攻击技术的覆盖有效性时前置条件提供或接受对象数据的目标 API 端点API 文档或 schema优先使用 OpenAPI 规范用于请求改写的 Burp Suite 或 Postman多个不同权限级别的用户账号普通用户与管理员账号对比尤为关键Python 3.8 环境并安装requests库用于自动化测试具备开展安全测试的合法授权未经授权对他人系统进行测试可能违反计算机欺诈相关法律三、漏洞模式剖析两类缺陷的典型形态3.1 Excessive Data Exposure响应中多出来的字段当GET /api/v1/users/123返回下述 JSON 时UI 实际只展示id、username、name而响应中携带了大量敏感字段{ id: 123, username: john_doe, email: johnexample.com, name: John Doe, ssn: 123-45-6789, // Sensitive - not needed by UI salary: 95000, // Sensitive - not needed by UI internal_notes: VIP client, // Internal - should not be exposed password_hash: $2b$12..., // Critical - never expose role: admin, // May enable privilege discovery created_by: system_admin, // Internal metadata credit_card_last4: 4242 // PCI compliance violation }这里的核心认知是前端过滤不等于安全。客户端把多余字段隐藏掉但完整响应在网络上可被任意拦截与读取安全性为零。仓库中另一份关联技能 exploiting-excessive-data-exposure-in-api/SKILL.md 对此有更细化的操作流程UI 展示字段与 API 实际返回字段的差异对比、响应头与错误响应中的调试信息泄露检测可与此技能配合使用。3.2 Mass Assignment请求体中注入的越权属性当更新接口把请求体直接绑定到 ORM 对象时攻击者可以附加字段// Normal user update request PUT /api/v1/users/123 Content-Type: application/json { name: John Updated, email: newexample.com, role: admin, // Attacker-injected: privilege escalation is_verified: true, // Attacker-injected: bypass verification discount_rate: 100, // Attacker-injected: business logic abuse account_balance: 999999 // Attacker-injected: financial fraud }role: admin直接造成权限提升is_verified: true绕过验证流程discount_rate/account_balance则构成业务逻辑滥用与金融欺诈。关于这一缺陷的专门利用方法论含 Rails/Django/Laravel/Spring 等 ORM 自动绑定框架下的参数发现技术仓库中还有一份 exploiting-mass-assignment-in-rest-apis/SKILL.md 可作为深入补充。四、自动化测试方法论BOPLA 扫描器完整实现SKILL.md 内置了一套完整的BOPLAScanner类用 Python 实现两类缺陷的自动化测试。它同时被 scripts/agent.py 封装为可直接运行的 CLI 工具。4.1 核心数据结构与字典表扫描器先定义两个关键数据源敏感属性模式字典SENSITIVE_PROPERTY_PATTERNS按严重级别分级CRITICAL / HIGH / MEDIUM / LOW用于对响应中出现但未被预期的字段进行敏感性归类。CRITICAL 级包含password、password_hash、secret、token、api_key、private_key、access_token、refresh_tokenHIGH 级包含ssn、credit_card、cvv、bank_account等金融数据MEDIUM 级包含salary、internal_notes、role、is_admin、session_id等权限与内部元数据LOW 级包含phone、address、date_of_birth等个人资料。批量赋值测试载荷MASS_ASSIGNMENT_FIELDS一组(字段名, 注入值)组合覆盖权限roleadmin、is_adminTrue、验证状态is_verifiedTrue、email_verifiedTrue、账户类型account_typepremium、subscription_tierenterprise、财务字段discount_rate100、credit_limit999999、account_balance999999与权限列表permissions[...]等典型目标。4.2 过度数据暴露检测test_excessive_data_exposure该函数对目标端点发起 GET 请求将实际响应字段与调用方提供的expected_fields期望字段集合做差集运算def test_excessive_data_exposure(self, endpoint: str, expected_fields: Set[str]) - List[BOPLAFinding]: Test if API response contains more fields than expected. findings [] url f{self.base_url}{endpoint} try: response requests.get(url, headersself.auth_headers, timeout10) if response.status_code ! 200: return findings data response.json() # Handle both single object and list responses objects data if isinstance(data, list) else [data] if isinstance(data, dict) and data in data: objects data[data] if isinstance(data[data], list) else [data[data]] for obj in objects[:5]: # Check first 5 objects if not isinstance(obj, dict): continue response_fields set(self._flatten_keys(obj)) unexpected_fields response_fields - expected_fields for field_name in unexpected_fields: severity self._classify_sensitivity(field_name) if severity: finding BOPLAFinding( endpointendpoint, methodGET, vulnerability_typeexcessive_exposure, severityseverity, property_namefield_name, detailsfUnexpected sensitive field {field_name} in response ) findings.append(finding) self.findings.append(finding) except (requests.exceptions.RequestException, json.JSONDecodeError): pass return findings实现要点单对象与列表统一处理既兼容data为数组或单字典的情况也兼容{data: [...]}的常见分页包装格式最多取前 5 个对象避免对超大规模列表响应造成不必要的请求开销递归展平嵌套键_flatten_keys方法把嵌套对象转换为a.b.c形式的点分路径确保深层嵌套对象中的敏感字段如user.profile.ssn不会被漏掉敏感性分级_classify_sensitivity取字段名最后一段去掉前缀做子串匹配命中即返回对应的严重级别未命中返回None从而跳过无害字段。4.3 批量赋值检测test_mass_assignment该函数先 GET 获取对象当前状态作为基线再逐一对MASS_ASSIGNMENT_FIELDS中的字段做注入测试并在注入成功后通过再次 GET 校验字段确实被修改随后尽可能恢复原值避免破坏测试环境def test_mass_assignment(self, endpoint: str, method: str PUT, original_data: Optional[dict] None) - List[BOPLAFinding]: Test if API accepts and processes additional injected properties. findings [] url f{self.base_url}{endpoint} # First, get the current object state if original_data is None: try: response requests.get(url, headersself.auth_headers, timeout10) if response.status_code 200: original_data response.json() else: original_data {} except (requests.exceptions.RequestException, json.JSONDecodeError): original_data {} # Test each mass assignment field for field_name, injected_value in self.MASS_ASSIGNMENT_FIELDS: if field_name in original_data: # Field exists - test if we can modify it original_value original_data[field_name] if original_value injected_value: continue # Already has this value test_data deepcopy(original_data) test_data[field_name] injected_value headers {**self.auth_headers, Content-Type: application/json} try: if method PUT: response requests.put(url, jsontest_data, headersheaders, timeout10) elif method PATCH: response requests.patch(url, json{field_name: injected_value}, headersheaders, timeout10) elif method POST: response requests.post(url, jsontest_data, headersheaders, timeout10) if response.status_code in (200, 201, 204): # Verify the field was actually modified verify_response requests.get(url, headersself.auth_headers, timeout10) if verify_response.status_code 200: updated_data verify_response.json() if updated_data.get(field_name) injected_value: finding BOPLAFinding( endpointendpoint, methodmethod, vulnerability_typemass_assignment, severityCRITICAL if field_name in [role, is_admin, permissions] else HIGH, property_namefield_name, detailsfSuccessfully injected {field_name}{injected_value} ) findings.append(finding) self.findings.append(finding) # Restore original value if possible if field_name in original_data: restore_data {field_name: original_data[field_name]} requests.patch(url, jsonrestore_data, headersheaders, timeout10) except requests.exceptions.RequestException: continue return findings关键设计值得注意HTTP 方法自适应PUT 发送完整对象含注入字段PATCH 只发送单字段载荷更贴近真实攻击手法POST 用于创建类接口双重确认机制仅当写请求返回 2xx且后续 GET 确认字段值等于注入值时才判定为漏洞最大程度降低误报严重级别差异化role、is_admin、permissions这类可直接提权的字段标为 CRITICAL其余财务/状态字段标为 HIGH状态回滚注入成功后如果原对象中存在该字段会尝试用 PATCH 恢复原值体现负责任的安全测试实践。4.4 GraphQL 属性暴露检测test_graphql_property_exposure该函数向 GraphQL 端点发送 introspection 内省查询探测 schema 是否被完整暴露def test_graphql_property_exposure(self, graphql_endpoint: str, query: str) - List[BOPLAFinding]: Test GraphQL APIs for property-level authorization issues. findings [] url f{self.base_url}{graphql_endpoint} # Introspection query to discover available fields introspection { __schema { types { name fields { name type { name kind } } } } } try: response requests.post( url, json{query: introspection}, headersself.auth_headers, timeout10 ) if response.status_code 200: data response.json() if errors not in data: finding BOPLAFinding( endpointgraphql_endpoint, methodPOST, vulnerability_typeexcessive_exposure, severityMEDIUM, property_name__schema, detailsGraphQL introspection enabled - full schema exposed ) findings.append(finding) self.findings.append(finding) except requests.exceptions.RequestException: pass return findingsGraphQL 内省开关本身就是一张属性级授权地图攻击者借它枚举出全部类型与字段名再逐个尝试读取敏感字段。SKILL.md 同时会在内省开启时给出__schema的 MEDIUM 级告警。4.5 报告聚合generate_report扫描结果统一汇总为结构化报告按漏洞类型excessive_exposure/mass_assignment与严重级别CRITICAL / HIGH / MEDIUM / LOW分组并附完整发现列表可直接喂给 SIEM、缺陷跟踪系统或检测规则生成流程支撑 DE.CM-01持续监控场景下的规则验证。五、命令行一键扫描运行 agent.pyscripts/agent.py 将上述类封装为标准 CLI。其参数解析逻辑main()函数支持--base-url必填API 基础 URL--endpoint必填待测试端点如/api/v1/users/1--tokenBearer Token会自动组装成Authorization请求头--expected-fields期望响应字段列表空格分隔--test测试模式exposure/mass_assignment/both默认both--method批量赋值测试使用的 HTTP 方法PUT/PATCH/POST默认PUT。典型调用方式来自 references/api-reference.mdpython skills/detecting-broken-object-property-level-authorization/scripts/agent.py \ --base-url https://api.example.com \ --endpoint /api/v1/users/123 \ --token eyJhbGciOiJIUzI1NiJ9... \ --expected-fields id username name email \ --test both --method PUT运行前需安装依赖pip install requests脚本在缺少requests时会明确提示。脚本输出 JSON 格式的结果包含findings列表、total_findings计数与by_severity严重级别统计便于脚本化集成。同时若希望将本技能对接到更广泛的攻击面评估或威胁狩猎流程可参阅仓库 mappings/README.md 了解 MITRE ATTCK、NIST CSF 等框架的映射组织方式以及 index.json 中该技能与仓库内其他 API 安全类技能的关联关系。六、手工验证补充requests 库与 Burp Suite 技巧在自动化扫描之外references/api-reference.md 给出了轻量的手工验证方法import requests # GET - test for excessive exposure resp requests.get(url, headers{Authorization: fBearer {token}}, timeout10) resp.status_code # 200, 401, 403 resp.json() # parsed response body # PUT - test for mass assignment resp requests.put(url, json{role: admin}, headersheaders, timeout10) # PATCH - test for partial mass assignment resp requests.patch(url, json{is_admin: True}, headersheaders, timeout10)配套的典型 Mass Assignment 测试载荷{role: admin} {is_admin: true} {is_verified: true} {account_type: premium} {discount_rate: 100} {permissions: [admin, write, delete]}Burp Suite 侧推荐组合扩展Autorize跨角色测试授权差异普通用户账号访问管理员功能Param Miner发现隐藏参数与可能的可绑定字段JSON Beautifier快速检查响应中的属性集合。七、修复与加固服务端显式白名单SKILL.md 给出了对应的服务端修复模式核心原则是永远不要在响应序列化时直接to_json()/to_dict()整个对象永远不要让框架把请求体原样绑定到模型7.1 响应侧按角色分级字段白名单# Server-side: Explicit property allowlists class UserSerializer: # Only expose these fields - never use to_json() or to_dict() PUBLIC_FIELDS [id, username, name, avatar_url] OWNER_FIELDS PUBLIC_FIELDS [email, phone, preferences] ADMIN_FIELDS OWNER_FIELDS [role, created_at, last_login] def serialize(self, user, requesting_user): if requesting_user.is_admin: fields self.ADMIN_FIELDS elif requesting_user.id user.id: fields self.OWNER_FIELDS else: fields self.PUBLIC_FIELDS return {field: getattr(user, field) for field in fields}7.2 请求侧可写字段白名单过滤# Mass assignment protection - explicit allowlist for writable fields WRITABLE_FIELDS {name, email, phone, avatar_url, preferences} def update_user(user_id, request_data, requesting_user): # Filter out any fields not in the allowlist safe_data {k: v for k, v in request_data.items() if k in WRITABLE_FIELDS} # Apply updates only with safe data User.objects.filter(iduser_id).update(**safe_data)在 Django REST Framework 中对应的落地方式是显式fields白名单 read_only_fields声明见 references/api-reference.md# Allowlist serialization (Django REST Framework) class UserSerializer(serializers.ModelSerializer): class Meta: model User fields [id, username, name] # explicit allowlist read_only_fields [id, role, is_admin]八、实战落地建议综合 SKILL.md 与配套文件建议按如下闭环落地 BOPLA 检测能力资产清单阶段梳理所有返回/接收对象数据的端点收集 OpenAPI 文档作为期望字段基线自动化扫描阶段为每个端点准备两个权限账号普通用户 管理员用agent.py分别跑--test both比较两类账号下的响应差异普通用户能看到管理员字段即为缺陷手工验证阶段对自动化告警用 Burp Suite 复测确认误报并记录可利用性修复阶段按第七章的响应侧 请求侧双白名单模式整改为敏感字段建立read_only_fields与WRITABLE_FIELDS约束监控阶段将扫描结果输出为检测用例映射到本技能 front matter 中声明的 MITRE ATTCK 技术T1190 / T1213 / T1212与 NIST CSF 控制项纳入日常监控覆盖验证DE.CM-01并通过仓库的 docs/mitre-f3-mapping.md 等映射文档沉淀为组织级检测知识。需要注意的是本技能面向已获授权的安全测试场景所有自动化载荷尤其是权限字段注入都应在测试环境或获得书面授权的目标上执行并在测试后尽量恢复对象原始状态。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考