01 / Report section
Executive summary
The application allows an authenticated customer to retrieve another customer’s basket by changing the identifier in a request. Authentication is present, but the server does not verify that the requested basket belongs to the caller.
Exploitation requires a valid account and a target basket ID. A successful request exposes the products and quantities in that basket. The weakness is a horizontal access-control failure and should be fixed at the server-side query boundary.
Finding / F-01
Another user’s basket can be retrieved
- Category
- Broken access control
- Asset
- GET /rest/basket/{id}
- Access required
- Authenticated customer
- Retest
- Not performed — demonstration
Observation
The basket route accepts an identifier from the path and returns the matching basket. The request must carry a valid session, but ownership of that basket is not compared with the authenticated user before the response is returned.
Reproduction
- 01Sign in as a normal customer and open the basket page.
- 02Capture the request used to retrieve the current basket.
- 03Change the numeric basket identifier and resend the request with the same authenticated session.
GET /rest/basket/2 HTTP/1.1
Host: juice-shop.test
Authorization: Bearer <customer-token>
HTTP/1.1 200 OK
Content-Type: application/json
{"data":{"id":2,"Products":[...]}}Impact
A customer can view another customer’s basket contents. In a production commerce system, the same control failure may also expose customer-linked records or allow basket manipulation, depending on which routes reuse the authorisation pattern.
03 / Report section
Remediation
Do not load a basket by its identifier alone. Resolve it through the authenticated user, or include both the basket ID and the caller’s user ID in the database query. Return the same not-found response for missing and unowned objects.
Regression test
Create two customers and two baskets. Assert that each customer can retrieve their own basket and receives no data when requesting the other customer’s identifier.
04 / Report section
Coverage notes
This demonstration covers the read path for a shopping basket. It does not claim coverage of checkout, payment, order history, administration, infrastructure or denial-of-service behaviour. A real report lists every role tested, the routes sampled and any constraint that reduced coverage.