2024 API Security High

API Security Misconfiguration

IDOR vulnerabilities in REST APIs and how broken object level authorization leads to data leaks.

Overview

Insecure Direct Object References (IDOR) are among the most common API vulnerabilities. When APIs expose internal object identifiers without proper authorization checks, attackers can access or modify data belonging to other users.

Type: IDOR / BOLA
Affected: REST APIs, GraphQL endpoints
Impact: Unauthorized data access
CVSS: 7.5 (High)

The Vulnerability

During API security assessments, we discovered multiple applications where user-specific resources were accessible simply by changing an ID parameter in the API request. The server failed to verify that the authenticated user owned or had permission to access the requested resource.

Technical Details

The vulnerable API endpoints used predictable sequential IDs and relied solely on these IDs to determine which resource to return. No verification was performed to ensure the requesting user had authorization.

// Vulnerable API endpoint GET /api/users/12345/profile GET /api/orders/98765/details // Attacker simply changes the ID GET /api/users/12346/profile // Another user's profile GET /api/orders/98764/details // Another user's order

Attack Scenario

User authenticates and receives session token
Application makes API calls with user/order IDs
Attacker intercepts request and modifies ID parameter
Server returns data for modified ID without authorization
Sensitive information of other users exposed

Impact

Exposure of personal identifiable information (PII)
Access to private messages and conversations
Viewing other users' payment details
Modifying or deleting other users' data

Remediation

Implement proper authorization checks for every endpoint
Use UUIDs instead of sequential IDs
Verify user ownership before returning resources
Regular API security testing

// Secure implementation app.get('/api/orders/:orderId', authenticate, (req, res) => { const orderId = req.params.orderId; const userId = req.user.id; const order = await Order.findOne({ where: { id: orderId, userId: userId } // Critical check }); if (!order) return res.status(403).json({ error: 'Unauthorized' }); res.json(order); });

Test your API security