Remediation of IDOR Vulnerability

What is an IDOR Vulnerability?

In a web application, whenever a user generates, sends, or receives a request from a server, there are some HTTP parameters such as “id”, “uid”, “pid” etc that have some unique values which the user has been assigned. An attacker can see such parameter values in cookies, headers, or wifi Packet captures. Via this, an attacker might be able to tamper with these values and this tampering may lead to IDOR....

How do IDOR Vulnerabilities Get Executed?

Let us first discuss the back-end working of a Web application that uses the unauthenticated medium in SQL, which leads to accessing user account information....

Steps Involved in the Execution of the IDOR Attack

Burp Suite Tool is widely used by attackers to execute such types of Attacks. Following are the steps being followed:...

Impacts of IDOR Vulnerability

Exposure of Confidential Information: When the attacker will have control over your account via this vulnerability, it is obvious that an attacker will be able to come across your personal information. Authentication Bypass: As the attacker can have access to millions of accounts with this vulnerability, it will be a type of Authentication bypass mechanism. Alteration of Data: An attacker may have privileges to access your data and alter it. By this, an attacker may have permission to make changes to your data, which may lead to the manipulation of records. Account Takeover: While an attacker may have multiple access to user accounts just by changing the “UID” values, this will lead to account takeover vulnerability. When one vulnerability leads to another vulnerability(like in this case), It is known as the Chaining of BUGS....

Remediation of IDOR Vulnerability

Developers should avoid displaying private object references such as keys or file names. Validation of Parameters should be properly implemented. Verification of all the Referenced objects should be done. Tokens should be generated in such a way that they should only be mapped to the user and should not be public. Use random identifiers so that it will be a little bit hard to guess for attackers.  Validation of user input should be properly implemented....