new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization/idor

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Insecure Direct Object Reference (IDOR) vulnerability

IDOR (Insecure Direct Object Reference) occurs when applications expose internal object identifiers (such as account numbers or Primary Keys) that can be accessed, guessed, or tampered with. For example, a URL like 'https://mybank.com/accountTransactions?acct_id=901' exposes an account identifier. If a user changes the acct_id parameter to another value like 523, they might be able to view transactions of another account if authorization checks are not properly enforced. This is related to CWE-639: Authorization Bypass Through User-Controlled Key and can result in authorization bypasses, horizontal privilege escalation, and less commonly vertical privilege escalation.

IDOR mitigation strategies

Recommended mitigations for IDOR vulnerabilities include: (1) Avoid exposing identifiers to the user when possible. For example, retrieve objects such as account details based solely on the currently authenticated user's identity and attributes through securely implemented JWTs or server-side sessions. (2) Implement user/session specific indirect references using tools such as OWASP ESAPI. (3) Perform access control checks on every request for the specific object or functionality being accessed. Just because a user has access to an object of a particular type does not mean they should have access to every object of that particular type.

Give your agent this brain