WebOTG-BAC-001 — Insecure Direct Object Reference (IDOR) Verification Procedure

1. Executive Summary & Scope

Insecure Direct Object References (IDOR) occur when an application provides direct access to objects based on user-supplied input without verifying whether the requesting user is authorized to access the requested resource. Attackers manipulate request parameters (such as database keys, filenames, or GUIDs) to access unauthorized records belonging to other tenants or users.

Standard Classification

OWASP Standard: OWASP Top 10 • Mapping: CWE-639 • Target Architecture: Public Web Systems & APIs

2. Threat Model & Attack Vectors

Attackers enumerate sequential or predictable identifiers via REST API endpoints to dump sensitive customer data, medical records, or proprietary corporate information across tenant boundaries.

3. Code Analysis & Remediation Playbook

Vulnerable Implementation Pattern

// VULNERABLE: Direct access without session-owner validation $invoiceId = $_GET['invoice_id']; $stmt = $pdo->prepare("SELECT * FROM invoices WHERE id = ?"); $stmt->execute([$invoiceId]); $invoice = $stmt->fetch(); echo json_encode($invoice);

Hardened Defense-in-Depth Implementation

// REMEDIATED: Enforce tenant / session boundary in database query $invoiceId = (int)$_GET['invoice_id']; $currentUserId = (int)$_SESSION['user_id']; $currentOrgId = (int)$_SESSION['organization_id']; $stmt = $pdo->prepare("SELECT id, amount, status, created_at FROM invoices WHERE id = ? AND organization_id = ?"); $stmt->execute([$invoiceId, $currentOrgId]); $invoice = $stmt->fetch(); if (!$invoice) { http_response_code(404); echo json_encode(['error' => 'Invoice not found or unauthorized']); exit; }

4. Audit Verification Checklist & Pass Criteria

Verification Phase	Audit Test Description	Mandatory Passing Criteria
Parameter Enumeration	Replay API requests substituting authenticated user ID with adjacent numeric and UUID targets.	System rejects with 403 Forbidden or 404 Not Found without leaking object existence.
Indirect Reference Maps	Replace raw database IDs in client payloads with session-scoped cryptographically random tokens or hashes.	Internal database primary keys are completely shielded from HTTP parameters.
Automated Boundary Fuzzing	Run authenticated differential fuzzing across User A and User B bearer tokens.	Zero data cross-contamination observed across concurrent sessions.

WebOTG Application Security Directorate

Senior Security Auditor

WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.