Back to Overview
MEDIUM SEVERITYCWE-639: IDOR
Insecure Direct Object Reference
IDOR occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
Common Attack Patterns
/api/users/123 -> /api/users/124/invoices?id=100 -> /invoices?id=101PUT /profile/123 (Change ID in URL)GET /messages/123 (Try accessing other user's message)POST /password_reset { 'user_id': 123 } -> 124How to Prevent?
- Implement proper access control checks for every object reference.
- Use indirect references (like random tokens) instead of database IDs.
- Validate that the current user owns the requested object.
- Use GUIDs/UUIDs instead of sequential IDs to make enumeration harder.