Account Takeover Series 3: Account Takeover through Insecure Direct Object Reference

Apr 29, 2022

What is Insecure Direct Object Reference?

Insecure Direct Object Reference or IDOR occurs when the application trusts the user input and takes sensitive action or shows sensitive information based on the same. This can be abused by an attacker to take sensitive action or dig out sensitive information from a victim’s account.

When an IDOR vulnerability is present in an application’s reset password functionality, the vulnerability can be exploited to update the user’s password, thus taking over the account of the victim user.

Vulnerable Application: Road

Attack Scenario: Marty is an attacker and he wants to take over the application’s admin account. The admin’s email id is previously known (admin@sky.thm).

Steps to Reproduce

Additionally, the user’s email address is provided to the application in the request.

The supplied email id can be edited by the attacker to any desired value. Let us change the email to the admin’s email: admin@sky.thm, and pass the request.

Next, you can see that the application responds successfully.

Log out and try to login through the newly created credentials, admin@sky.thm:1234. Observe that the application shows a successful response and the attacker is logged in.

Mitigation

The most common and easy method of prevention against IDOR is to not rely solely upon the user input. There should be a validation for the same in the backend logic.
Strict access control should be enforced to limit the reference of objects outside of the intended permission.