Quartz 5

Vault API - Test Cases

4 min read

pentest api-security vault aws ssm okta idor bola appsec

Vault API — Test Cases

Organized test ideas and checklists for the Vault API engagement. Track execution in Vault API - Evidence Log; promote confirmed issues to Vault API - Findings.

Authentication

  • Okta enforcement — is every endpoint protected?
  • Bearer token validation — signature, issuer, audience, binding
  • Token expiration and refresh behavior
  • Replay — can a captured token be reused?
  • Token leakage — responses, logs, referrer headers, client-side storage
  • Unauthenticated access attempts on all endpoints

Authorization / BOLA / IDOR

  • Cross-team access — Team A user requesting Team B secrets
  • Object-level access control — per-secret / per-resource enforcement
  • Resource ID manipulation — swap IDs in path, body, or query
  • Team ID manipulation — client-supplied vs server-derived Team ID
  • Application ID manipulation
  • Parameter path / name manipulation

Important

Core question: Is Team ID trusted from the request, or derived from authenticated identity? See Vault API - Kickoff Questions.

Team Isolation

  • Team A vs Team B — horizontal privilege escalation
  • Identity-to-team association — server-side enforcement?
  • Multi-team identity — are boundaries maintained per team?
  • Enumeration — can one team list another team’s resources?

Function-Level Authorization

Test each operation independently per role/team:

  • Read
  • Create
  • Update
  • Delete
  • Rotate
  • Admin / management functionality

Tip

A user authorized to read Team A secrets must not implicitly gain delete or rotate access unless explicitly granted.

  • Can a lower-privileged operation (read) be chained into a higher-privileged one (delete/rotate)?

Secret Handling

Check for leakage through:

  • API responses (values, partial values, hints)
  • Error messages and stack traces
  • Application and infrastructure logs
  • Debug or verbose modes
  • Metadata fields (timestamps, owners, paths)
  • Caching layers (CDN, proxy, client cache headers)

Business Logic

  • Abuse of legitimate flows (e.g., create-then-read across teams)
  • Replay of state-changing requests
  • Chaining operations to bypass checks
  • Workflow bypass — skipping required steps in secret lifecycle

Input Validation

  • IDs — integer, UUID, sequential, predictable
  • Parameter names and paths — traversal, namespace escape
  • Metadata fields — injection or override
  • Structured input — JSON fields that influence authorization

Rate / Resource Controls

  • Enumeration — listing secrets, teams, or applications
  • Excessive requests — bulk retrieval
  • Resource consumption — large payloads, rotation storms
  • Rate limits (if any — see Vault API - Kickoff Questions)

Error Handling

  • Sensitive data in error responses
  • Verbose errors exposing internal paths or IDs
  • Behavior when authentication succeeds but authorization should fail

Logging / Audit

  • Are access attempts logged with identity, team, and resource?
  • Do failed authorization attempts generate alerts?
  • Where are security/audit logs available? (see Vault API - Kickoff Questions)

AWS Permission Boundary

  • Least privilege — does the backend role exceed what Vault should need?
  • SSM resource scoping — path-level IAM restrictions
  • Impact assessment — what happens if Vault authorization is bypassed?
  • What does the Vault backend AWS role have access to?

See Vault API - Architecture > AWS SSM Parameter Store.

Environment Separation

  • Test, Staging, Production — distinct endpoints, credentials, data
  • Identity crossover — can a staging token reach production?
  • Data crossover — production secrets in non-production environments
  • Permission crossover — broader IAM in lower environments
  • Are tokens bound to environment, or reusable across environments?

Key Questions (Testing Checklist)

Use during active testing; unresolved items → Vault API - Kickoff Questions.

  • Who can access which secrets?
  • Is Team ID trusted from the request, or derived from authenticated identity?
  • Can one team enumerate another team’s resources?
  • Are read, write, delete, and rotate permissions independently enforced?
  • What does the Vault backend AWS role have access to?
  • Can paths or identifiers escape intended namespaces?
  • Are secrets exposed in errors, logs, or metadata?
  • Are Test, Staging, and Production isolated?
  • Are sensitive actions audited?

Graph View

Backlinks