Top 235 IDOR Bug Bounty Reports

What is IDOR?

IDOR, or Insecure Direct Object Reference, is a security flaw that allows attackers to access unauthorized data by manipulating references to objects. This vulnerability arises when an application fails to implement proper access controls, enabling users to retrieve or modify sensitive information they shouldn’t have access to.

For example, consider a URL like this: https://example.com/account.php?id=24 This request retrieves data for the user with ID 24. However, if an attacker changes the id parameter to 11 (https://example.com/account.php?id=11) and gains access to another user’s data, this is a classic IDOR vulnerability.

Free Article Link: Click here 👈

Types of IDOR Vulnerabilities

IDOR vulnerabilities can manifest in various forms, each with its own implications:

1. Blind IDOR: The attacker cannot directly see the results of their actions in the server response. For example, modifying another user’s private data without confirmation.
2. Generic IDOR: The attacker can directly observe the results of their actions, such as accessing another user’s confidential information.
3. IDOR with Reference to Objects: Unauthorized access to objects like bank accounts or user profiles by manipulating reference IDs. Example: example.com/accounts?id={reference ID}
4. IDOR with Reference to Files: Unauthorized access to files stored on the server. Example: A chat server storing logs as example.com/1.log, example.com/2.log, etc., which can be accessed sequentially.

How to Find IDOR Vulnerabilities

Identifying IDOR vulnerabilities requires a systematic approach:

1. Monitor Requests: Capture all requests sent by your browser to the server. Look for parameters in URLs, headers, or cookies that reference objects or files.
2. Decode Values: Often, IDs are encoded or hashed. Use tools to decode these values (e.g., MD5 hashes) to understand their structure.
3. Test API Endpoints: APIs are a common source of IDOR vulnerabilities. Analyze API requests, tamper with parameters, and observe the responses.
4. Check Access Controls: Verify if the application enforces proper access controls. For example, ensure users cannot access data beyond their permissions.

This article highlights some of the most notable IDOR reports from HackerOne, based on the publicly disclosed reports compiled in this GitHub repository.

Notable IDOR Reports

1. IDOR in PayPal — Adding Secondary Users

• Company: PayPal
• Bounty: $10,500
• Summary: The vulnerability allowed unauthorized users to add secondary users to business accounts, potentially leading to account takeovers and fraudulent transactions.
• Report Link

2. IDOR in Vimeo — Resetting Passwords

• Company: Vimeo
• Bounty: $5,000
• Summary: Attackers could exploit an IDOR vulnerability to reset passwords for other users, leading to full account compromise.
• Report Link

3. IDOR in NordVPN — Accessing Payment Data

• Company: NordVPN
• Bounty: $1,000
• Summary: Attackers could view sensitive payment details of any user by modifying request parameters, exposing personal financial information.
• Report Link

4. IDOR in Shopify — Expiring Other User Sessions

• Company: Shopify
• Bounty: $1,000
• Summary: A flaw allowed users to terminate other users’ active sessions, leading to potential security risks such as session hijacking.
• Report Link

5. IDOR in Uber — Bulk Lookup of Driver UUIDs

• Company: Uber
• Bounty: $500
• Summary: Attackers could enumerate and retrieve Uber driver UUIDs, leading to potential privacy and data security risks.
• Report Link

6. IDOR in Twitter — Statistics Leakage in Orders

• Company: Twitter
• Bounty: $289
• Summary: An IDOR flaw allowed attackers to access sensitive business statistics from Twitter’s advertising platform, leading to information disclosure.
• Report Link

7. IDOR in Zomato — Deleting Images from Other Stores

• Company: Zomato
• Bounty: $600
• Summary: Attackers could delete images from other restaurants’ profiles, leading to potential reputational damage and business impact.
• Report Link

Lessons from These Reports

Analyzing these IDOR reports reveals common patterns in how these vulnerabilities are exploited:

1. Lack of Proper Authorization Checks: Many applications fail to validate whether a user has permission to access or modify an object.
2. Predictable Object References: Sequential or easily guessable object IDs allow attackers to enumerate and manipulate them.
3. Insecure API Implementations: APIs are often vulnerable to IDOR when proper authentication and authorization controls are missing.
4. Exposure of Sensitive Information: IDOR often leads to unauthorized access to personal, financial, or business-sensitive data.

How to Prevent IDOR Vulnerabilities

To mitigate IDOR risks, developers and security teams should:

• Implement proper access controls at both the frontend and backend.
• Use randomized and non-sequential object identifiers to make enumeration harder.
• Enforce role-based access control (RBAC) to ensure only authorized users can access certain resources.
• Conduct regular security audits and penetration tests to identify and fix IDOR issues.
• Use log monitoring and anomaly detection to identify suspicious access patterns.

IDOR vulnerabilities remain a critical security risk, affecting some of the largest tech companies worldwide. Ethical hackers have played a significant role in uncovering and reporting these flaws, earning substantial bounties in the process. By learning from past reports and implementing robust security practices, developers can significantly reduce the likelihood of IDOR exploits in their applications.

For more details, explore the full list of top IDOR reports on GitHub.