Autonomous Agent Exploits BOLA in Airline GraphQL API, Exposing Passenger Data
Summary
Wiz says its Red Agent autonomously exploited a BOLA flaw in an airline’s GraphQL API, accessing passenger records and gaining the ability to modify or delete bookings. The company says it validated access using 20 sequential booking IDs.
Key points
- The agent used client-side JavaScript analysis to map the backend, obtained an anonymous session, and introspected the GraphQL schema.
- GraphQL resolvers accepted sequential booking IDs without enforcing object-level authorization; all 20 sequential IDs tested returned distinct customer profiles.
- Exposed records included names, dates of birth, contact details, billing addresses, masked card data, loyalty numbers, and travel itineraries.
- The anonymous session could alter contact emails, delete flight segments, separate travel groups, change prices, and issue refunds.
- Wiz says the full discovery and validation took 15 minutes and required no prior target knowledge or credentials.
- The article recommends enforcing authorization checks at every resolver and restricting GraphQL introspection in production.
Article Details
- Attack Vectors
- The Red Agent used an anonymous session token to access GraphQL booking resolvers that accepted sequential integer booking IDs without enforcing backend, object-level authorization.
- It mapped client-side JavaScript and obtained a session by replaying the token acquisition flow with empty credentials.
- GraphQL schema introspection exposed queries and mutations to the anonymous session; testing sequential booking IDs enabled retrieval of passenger records and access to booking-modification operations.
- Defensive Notes
- Enforce user- and object-specific authorization checks in every backend resolver.
- Use non-guessable identifiers, while still enforcing authorization independently of identifier unpredictability.
- Restrict GraphQL introspection in production.