Identification and Illustration of Insecure Direct Object References and their Countermeasures

Abstract

The insecure direct object reference simply represents the flaws in the system design without the full protection mechanism for the sensitive system resources or data. It basically occurs when the web application developer provides direct access to objects in accordance with the user input. So any attacker can exploit this web vulnerability and gain access to privileged information by bypassing the authorization. The main aim of this paper is to demonstrate the real effect and the identification of the insecure direct object references and then to provide the feasible preventive solutions such that the web applications do not allow direct object references to be manipulated by attackers. The experiment of the insecure direct object referencing is carried out using the insecure J2EE web application called WebGoat and its security testing is being performed using another JAVA based tool called BURP SUITE. The experimental result shows that the access control check for gaining access to privileged information is a very simple problem but at the same time its correct implementation is a tricky task. The paper finally presents some ways to overcome this web vulnerability.

Toward a readiness model for secure software coding

“…Secure software coding challenges SSC is not as simple as it seems to be, various challenges are faced during this process. Some critical challenges involved in SSC are listed below [38][39][40][41][42][43][44][45][46][47][48][49][50] :…”

“…SSC is not as simple as it seems to be, various challenges are faced during this process. Some critical challenges involved in SSC are listed below 38‐50 : Injection, Broken authentication and session management, Cross‐site scripting Insecure direct object reference, Security misconfiguration, Sensitive data exposure, Missing function level access control, Cross‐site request forgery, Using components with know vulnerabilities, Invalidated redirects and forwards, Data validation, Authentication, Session management, Authorization, Cryptography, Error handling, Logging, Security configuration, Network architecture. …”

On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids

“…Access control vulnerabilities are typically divided in horizontal and vertical privilege escalation vulnerabilities, where the first refers to a user performing actions or accessing data of another user with the same level of permissions and the second refers to performing actions or accessing data of users with elevated privileges [87]. An example of broken access control are insecure direct object references (IDOR) vulnerabilities, where the persistent object can be accessed directly through the application interface, e.g., a URL that includes the internal id of the object [88]. The impact of broken access control exploitation can range from information disclosure to complete host takeover.…”

Survey on detecting and preventing web application broken access control attacks

“…Common access control flaws include the following i) Allowed forced browsing to pages requires authentication for unauthenticated users, or allows access to a highly privileged page from users with inadequate rights; in this category, the vulnerability occurred when some private pages (e.g., back up files, operations, and configuration files) does not have proper authentication and authorization policies which allow an intruder to exploit this flaw and accesses those restricted pages or resources through directly accessing their uniform resource locator (URL) bypassing the intended but not properly implemented normal authentication and authorization procedure; ii) Another type occurs when some specific functions that only intended to be accessed from a specific user role (e.g., bank approver role) while the application implementation allows the other user (e.g., maker role) to call the approving function directly to process an item despite the authorization level; iii) Another critical broken access control category occurs when a standard low-privileged user can gain increased privileges, such as being able to act as an administrator by tricking the application into thinking that the user is an administrator, this can take place through multiple scenarios including manipulating user session parameters or accessing admin portal functions and escalate the user or the session rights; iv) Another type of access control vulnerability in HTTP request methods occurs when an application fails to restrict access to certain HTTP methods (e.g., PUT request method or DELETE request method) which allows the intruder to utilize the web method to manipulate the application integrity and confidentiality; v) Other types of access control violations can especially exist in multi-step operations or workflows where the access control rules may be applied on specific steps but are not applied consistently on other steps moreover it may occur when contextual access control rules do not take into consideration the steps execution order and prerequisites steps for each specific step, a common example for this vulnerability is not preventing the modification of the shopping cart items after order bill calculation; and vi) Another major category of broken access control vulnerabilities is what is commonly named insecure direct object reference (IDOR) [10] which occurs when an application exposes a reference to an internal object directly without validating the request authentication and authorization parameters, as an example, consider a web application that allows the user to retrieve his personal information saved at a specific system using his national identification number (NIN) through the following web application sample URL (e.g., example.com/show_my_details/NIN/28889900001); however, a malicious actor can modify the NIN parameter in the URL to view other user's personal information through typing the target user's NIN (e.g., example.com/show_my_details/NIN/28889900002), this example can apply to other resources.…”