IDOR

When you view your invoice at an online shop, the address bar of your browser often shows a number, for example invoice=1042. This number tells the website which document to hand out. Now you type 1043 instead of 1042 and press Enter. If the invoice of a stranger now appears, exactly the error this entry is about has occurred. It is called IDOR, spelled out Insecure Direct Object Reference, roughly meaning an unsafe direct reference to an object. The problem is not the number itself, but that the website forgets to check whether you are even allowed to see this document.

Why a changed digit opens entire databases

The attack requires no special knowledge whatsoever. An ordinary browser and the willingness to count up a number are enough. That is exactly what makes IDOR so dangerous: there is no technical hurdle to hold back random curious people. Anyone wanting to exploit such flaws systematically writes a small program that tries out the numbers 1 through 500,000. Within a few hours, an entire customer database then sits on the attacker’s hard drive.

Several major data breaches of recent years have followed exactly this pattern. Affected were government portals, health apps, vaccination-certificate systems, and ticket providers. Usually a security researcher reports the flaw after noticing it by chance while using the site normally. For companies, such an incident is costly, because in Europe the General Data Protection Regulation applies. It can demand fines if personal data was poorly protected.

Experts therefore count IDOR among the most important web vulnerabilities of all. In the well-known ranking by the organization OWASP, an association for application security, the associated category Broken Access Control has held the top spot for years. It describes flawed access control in general. IDOR is the most common and simplest case of it.

The forgotten check behind the address bar

Every website must keep two things separate. First: who are you? That is settled by the login with username and password. Second: what are you allowed to see? That is a separate check, which must take place anew with every single request. With IDOR, the first step happens correctly, but the second one is skipped. The server thus recognizes you as a logged-in user and then readily hands out other people’s data records as well.

A common misconception behind this is: you can’t even change the number, because no link in the menu leads there. But the address bar can be overwritten freely. Hidden fields in forms or requests from a mobile app can also be read and altered with free tools. Security that relies solely on something being hard to find is called security through obscurity. It is considered worthless.

The clean solution is simple to describe. The server checks with every request in the database whether the requested object belongs to the logged-in account. If it doesn’t match, an error message is returned instead of the data. Additionally, long random identifiers are often used instead of sequential numbers. That makes brute-forcing harder, but does not replace the actual check.

IDOR in reports about data breaches

In news reports, the word rarely appears directly. Instead, it is said that customer data was accessible via a simple change to the web address. This almost always refers to IDOR. Such reports often come from the Chaos Computer Club or from individual security researchers who report flaws responsibly.

AI products are affected too, as soon as they have user accounts. A chatbot stores conversation histories that are retrieved via an identifier. If the check is missing there, you end up reading other people’s conversations. Especially with quickly developed add-on services around language models, such errors have occurred repeatedly. Large companies therefore pay rewards to finders, so-called bug bounties, often in the range of a few thousand euros per reported flaw.

One final note: deliberately trying out other people’s numbers on real websites is a criminal offense in Germany, even without malicious intent. Anyone wanting to practice such technique should use environments designed for training. Anyone who stumbles upon a flaw by chance should report it to the operator and not download any data.