---
# System prepended metadata

title: Insecure Direct Object Reference (IDOR)

---

# Insecure Direct Object Reference (IDOR)

## Overview of the Vulnerability

Insecure Direct Object Reference (IDOR) occurs when there are no access control checks to verify if a request to interact with a resource is valid. An IDOR vulnerability within this application can be leveraged by an attacker to manipulate, destroy, or disclose data through their ability to bypass access controls and  horizontally or vertically escalate their privileges. 

Given the type of IDOR within an application, an attacker could perform the following actions:

- Gain unauthorized access to data from the application and retrieve privileged information
- Perform unauthorized operations, such as escalating their privileges within the application, or forcing a password change on a user’s account in order to takeover that account
- Manipulate internal application objects and elevate their privileges, alter data, or gain access to and manipulate the application’s APIs
- Gain direct access to files and manipulate the file system, such as uploading, downloading, adding, or deleting data, including other user’s data.

## Business Impact

IDOR can lead to indirect financial loss through an attacker accessing, deleting, or modifying data from within the application. This could also result in reputational damage for the business through the impact to customers’ trust. The severity of the impact to the business is dependent on the sensitivity of the data being stored in, and transmitted by the application.

## Steps to Reproduce

### Rating : 

1. Login to User Account n°1
2. The account n°1 upload an image (the uuid of this image is: e285e1b1-4d7b-4467-9cdf-a1f12cfb7337)
3. User n°2 intercept the image uuid of the user n°1
4. By running the following request, User n°2 can rate the image uploaded by user n°1: 
`PATCH /images/e285e1b1-4d7b-4467-9cdf-a1f12cfb7337`

Example of a request made by user n°2
![](https://i.imgur.com/7ihyeyz.png)


### Getting : 
1. Login to User Account n°1
2. The account n°1 upload an image 
3. User n°2 intercept the image uuid of the user n°1 (the uuid of this image is: e285e1b1-4d7b-4467-9cdf-a1f12cfb7337)
4. By running the following request, User n°2 can rate the image uploaded by user n°1: 
`GET /images/e285e1b1-4d7b-4467-9cdf-a1f12cfb7337`

Example of a request made by user n°2
![](https://i.imgur.com/79DhW9M.png)




## Preventing IDOR Vulnerabilities


Verify the sessions cookies when requesting an image, users are not supposed to access to any images from an other users.

