Just think that you are holding a magic key that lets you into your bedroom among everyone else. But if a person finds how to duplicate that key, he or she can just walk into your room unnoticed. Well, that is basically what goes down with an Insecure Direct Object Reference (IDOR). IDOR is an acronym for it and means there is a way to read and/or write an application’s data by knowing what is referred to as a “key.” In this blog, we will discuss what IDOR is, why it poses a threat, and ways to mitigate this kind of attack.
What Is an Insecure Direct Object Reference (IDOR)?
In this type of website, the website offers the user unrestricted access to the materials needed, like files or data, without asking the user’s permission. For example, let’s say you’re on a website and your account URL is something like: For instance, suppose you are on a website and your account URL is:
https://www.example.com/settings/user/1001
If a person assumes that substituting the number with 1002 will take him/her to another person’s account and it does, then this is an IDOR weakness. The website did not give the assurance that that specific person has permission to even see the other account. This may lead to people observing and modifying that which they should not, such as the latter, which includes saying some information or some settings.
There are two reasons that IDOR vulnerabilities are bad. Other big companies like Facebook and Vodafone, for instance, have in the past fallen prey to what is commonly referred to as IDOR. There is a worry that developers have to fix so that websites’ security is not at risk.
If you’re curious about learning more about how to find and fix problems like this, you might want to check out an Certified Ethical Hacker Course.
How To Prevent Insecure Direct Object References
IDOR prevention is summarized in ensuring that the user has access only to data that he needs to read or modify.
Here are some ways to do that:
Indirect Reference Maps
An effective method to eliminate IDOR is indirect reference maps. This means instead of using something like IDs in the URLs, the website not only uses a complicated variable but a variable that is virtually impossible to guess. For example, instead of:
https://www.example.com/settings/user/1001
The website could use something like:
https://www.example.com/settings/user/e194da7f-3d74-48e9-ac49-4c72e1b02eeb
This makes it much easier for an individual not to have another person have an easy time guessing his or her code. The website has the records of which code is relevant to which user, but an attacker will not be able to know it.
But this is not the one hundred percent of effectiveness. Even if an attacker somehow manages to get his/her hands on such codes, there is trouble ahead, as we are going to mention below. That’s why one must ensure that this method is used in conjunction with other security measures.
Fuzz Testing
Fuzz testing is like when one tries to force a toy to break so as to determine the strength of the toy. In the case of websites, it involves feeding the site with any form of data at random or uninstalling expected data input to test the site’s ability to respond. If the site does not accept the weird data, then it can manifest issues such as IDOR.
For instance, while trying to implement fuzz testing tools, the developers attempt to determine whether the web site can be browsed on by inputting slightly different numbers or letters in the URL. This assists them to identify the areas of vulnerability within the site in question.
Fuzz testing should ideally be performed periodically to identify IDOR vulnerabilities before the ‘bad guys’ get a chance to do it.
Parameter Verification
Parameter validation is in fact all about checking that the data entered by the user is actually acceptable and logical. For instance, if a user enters a number, the web site should verify if it is in the given range or if it is in the correct format.
Here are some key checks:
- Avoid strings (like text) from being too short as well as too long.
- Make sure that the value comes within those ranges or not.
- Make sure that the inputs provided are of the correct format, such as dates or numbers, and don’t contain prohibited characters.
With such checks, it becomes difficult for the attackers to manipulate the website by inputting wrong data. Another layer of security against IDOR is introduced by the parameter verification.
Access Validation
To ensure that IDOR is not carried out, it is recommended that access validation be conducted to the highest degree possible. It means that in case a user would like to perform certain action, for example, open a file or change the configuration, the website should verify whether this user is allowed to do this.
This has to be done at the server side and not at the individual user side so that people cannot manipulate the system. For instance, if one attempts to alter the URL to get an assessment of another individual, then the server should seek whether the alteration is valid or has authority to accomplish the action. If they do not, the website should deny the request.
It is recommendable that access validation be done at multiple levels to reduce the chances of open gaps that attackers may use.
Related post Building a simple vulnerability scanner
Conclusion
The IDOR threats are dangerous for websites since they allow an intruder to manipulate parameters that identify specific objects, but it is possible to protect against them. They recommended indirect reference maps, fuzz testing, parameter testing, and access validation as ways to ensure that developers themselves do not leave their sites vulnerable to hackers.
Safety on the Internet is the process of continuously searching for dangers or possible threats. If you want to know more about details of cybersecurity and how to prevent websites from IDOR threats, go through an Ethical Hacking Course.
Implementing these methods in your development process will assist in protecting your site as well as its users from attackers.