IDOR Vulnerability to Log Out Another User

What is IDOR?

A particular kind of access control vulnerability known as IDOR occurs when an application directly accesses objects using input provided by the user.

What is the impact of IDOR?

Because the server unquestioningly accepts the session ID supplied without adequate validation, an attacker can use it to log out another user.

Mitigation:

1. Do Not Trust the Session ID from the User

• Session IDs from request parameters (such as GET/POST) should never be accepted by input server-side code.
• Session IDs from secure, HTTPOnly cookies should always be used.

2. Session Binding to User Identity

• Session IDs should only be linked to the server’s authenticated user.
• Verify that the session belongs to the person who is presently logged in, even if someone sends you a different session ID.

3. Authorization Check

• Verify that the person acting is the session owner at all times, even if the session ID is passed.

4. Use Secure Cookies for Session IDs

• Mark cookies as:
  • HttpOnly (so JS can’t access it)
  • Secure (sent only over HTTPS)
  • SameSite=Strict (to prevent CSRF)

5. Regenerate Session ID on Login and Logout

• Minimizes the likelihood of session hijacking and stops session fixation.

Supporting Material/References:

1. https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html
2. https://book.hacktricks.xyz/pentesting-web/idor

POC

Step 1

• As the user “wiener,” log in to the website and intercept the logout request.

Step 2

• Forward the intercepted logout request to the Repeater in Burp Suite for additional examination and manual testing.

Step 3

• To intercept the request, open a private browser session, log in using a new account, and then refresh the page.

 

Step 4

• Examine the intercepted request’s session ID to examine its composition and application.

Step 5

• Send the second request and check the answer after changing the session ID to match the one from the first logout request. A status code of 200 was given by the answer.

 

Step 6

• Check the response for the phrase “See you again” to confirm if both users have been logged out.

Step 7

• Once the page has been refreshed, note that both users have been automatically logged out.

Read More:

A Retired IAF Officer Defrauded with ₹1 Cr Placed Under Digital Arrest

About Author