Context#
Parameter omission exploits multi-action handlers and default branch logic: if approve is absent, the code path may default to approve; if amount is missing, a fee waiver branch may run. Distinct from step skip (different URL) and from BOLA on ids (this is presence of fields, not wrong id).
Theory#
JSON merge, PATCH, and form encoding differ on null vs missing vs empty string. The exploitable pattern is a deny-only or fall-through check rather than an explicit allow: if (body.approve === false) return deny() followed by an approve branch treats an omitted approve (which is undefined, not false) as not-denied and falls through to approval. Likewise if (body.amount) chargeFee() skips the fee entirely when amount is omitted, and a validator that only runs when a field is present is simply not run for the omitted field.
Practice#
One-parameter-at-a-time drop#
- In a proxy, remove each JSON key from a state-changing request and diff responses and side effects on test data.
Empty vs missing vs null matrix#
- Send
{},{"approve":null},{"approve":""}for the same endpoint and record which combination crosses a gate.
Tools#
- Burp Suite
- curl
References#
- PortSwigger Web Security Academy: Business logic vulnerabilities
- OWASP WSTG: Testing for Business Logic