Just a moment...
Imrane T. — Offensive Security | Attack Chains & Business Logic
One authenticated session. One changed member ID. One missing ownership check.
While testing an API flow, I found that changing a client-controlled memberId allowed the session to resolve another account’s preference state.
Same session.
Different account object.
HTTP 200.
The returned data itself wasn’t highly sensitive. The interesting part was the authorization boundary behind it.
I broke down the validation process, root cause and remediation here:
https://medium.com/@insid_e/when-one-integer-crosses-the-authorization-boundary-60f782538213
#APISecurity #IDOR #Authorization #AppSec
4 reactions · 0 comments
Topics: #appsec, #authorization, #idor, #apisecurity