What is Insecure Direct Object Reference?
Insecure Direct Object Reference or IDOR occurs when the application trusts the user input and takes sensitive action or shows sensitive information based on the same. This can be abused by an attacker to take sensitive action or dig out sensitive information from a victim’s account.
When an IDOR vulnerability is present in an application’s reset password functionality, the vulnerability can be exploited to update the user’s password, thus taking over the account of the victim user.
Vulnerable Application: Road
Attack Scenario: Marty is an attacker and he wants to take over the application’s admin account. The admin’s email id is previously known (email@example.com).
Steps to Reproduce
Log in to the application as the user Marty. Go to the reset user page and fill in the new password.
Additionally, the user’s email address is provided to the application in the request.
The supplied email id can be edited by the attacker to any desired value. Let us change the email to the admin’s email: firstname.lastname@example.org, and pass the request.
Next, you can see that the application responds successfully.
Log out and try to login through the newly created credentials, email@example.com:1234. Observe that the application shows a successful response and the attacker is logged in.
The most common and easy method of prevention against IDOR is to not rely solely upon the user input. There should be a validation for the same in the backend logic.
Strict access control should be enforced to limit the reference of objects outside of the intended permission.
What is Account Take Over Attack (ATO)?
ATO Attack Series 1: Cross-Site Request Forgery Account Takeover
ATO Attack Series 2: Account Takeover through Password Reset Poisoning
Start Protecting your Credentials Today! Get in touch with CSW for Red Teaming and VMaaS services.