Skip to content

Commit 00fb42c

Browse files
pcx feedback
1 parent 086c7b7 commit 00fb42c

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

src/content/docs/api-shield/security/bola-vulnerability-detection.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ The BOLA enumeration label requires an endpoint to have seen at least 10,000 ses
4141

4242
## Parameter pollution
4343

44-
Cloudflare detects anomalies where one or more successful requests containing a value in an expected path, query string or header have that value duplicated in an unexpected, similar location.
44+
Cloudflare detects anomalies where one or more successful requests containing a value in an expected path, query string, header, or cookie have that value duplicated in an unexpected, similar location.
4545

4646
This behavior may be indicative of attackers trying to confuse the API's authorization system and bypass security controls.
4747

@@ -50,7 +50,7 @@ Cloudflare detects anomalies where one or more successful requests containing a
5050

5151
- **Normal behavior**: `orderId` sent in a path variable like `GET /api/v1/orders/12345`
5252
- **Attacker behavior**: `orderId` is also sent as a query parameter, triggering old, undocumented code that looks for orders in the query parameter and happens to lack an authorization check: `GET /api/v1/orders/12345?orderId=67890`
53-
- **Result**: By passing in a bogus order or an order that the attacker owns (`12345`), they are able to trigger the old, undocumented code and access an order that they do not own (`67890`)
53+
- **Result**: By passing in a fake order or an order that the attacker owns (`12345`), they are able to trigger the old, undocumented code and access an order that they do not own (`67890`)
5454
</Details>
5555

5656
## Process

0 commit comments

Comments
 (0)