🔥 IDOR: The Eternal Classic
A short look at one of the most common vulnerabilities on the web.
IDOR stands for Insecure Direct Object Reference. It's a type of vulnerability that commonly occurs when the attacker has control over some identifier to an object, and the application does not properly ensure that the attacker has access to the object behind said identifier.
It's one of the most common vulnerabilities in web applications, as a single missing permission check is usually sufficient to make the service vulnerable. Today, we will look at an example of such vulnerability in NationStates, a videogame.
📩 NationStates allows sending in-game messages - "telegrams" - to other users. Players looking to send a large amount of messages can do so using "stamps", a paid in-game item. Such senders have access to deliverability reports which show which users have received the telegram, which users have blocked the recipient, as well as a "secret key" for API purposes.
To receive a deliverability report, NationStates utilizes the following method: https://www.nationstates.net/page=ajax3/a=tgreportexpand/tgid=123456/code=200. By default, only the sender is able to access the report, while other players do not have the ability to do so.
👨💻 However, the method in question leaves an attacker-controlled tgid field and does not properly check if the attacker is the sender of the message. Thus, this method is vulnerable to the IDOR weakness. By manipulating the tgid field, a malicious actor is capable of achieving information disclosure of otherwise unavailable or confidential information. The issue has been responsibly disclosed and fixed before this post.
✨ It's easy to see how IDOR can lead to much more severe security issues, for example in POST requests, where the attacker might potentially modify information controlled by other users - user posts, online store orders, email forwarding preferences, and so on.
It is crucial that software developers treat user-supplied input values as inherently insecure and implement appropriate permission checks.
Hope you've learned something new today. Stay safe!
