Insecure Direct Object Reference (IDOR)
An Insecure Direct Object Reference, or IDOR, is a vulnerability where an application exposes a direct reference to an internal object, such as a database id, a filename, or a primary key, and lets a user access that object without checking whether they are actually authorized to do so.
IDOR is typically exploited by tampering with an identifier in a URL, form field, or API payload, and substituting it with another value: if the application trusts the identifier without an authorization check, the attacker reaches data or actions that belong to someone else.
Mitigations include enforcing an authorization check on every request that references an object, and using indirect, unpredictable references, such as UUID or per-user mapping tables, instead of sequential ids.
<?php
// IDOR: any authenticated user may fetch any invoice, just by changing the id
$id = $_GET['invoice_id'];
$invoice = $db->query("SELECT * FROM invoices WHERE id = $id");
// Mitigation: also verify ownership of the requested object
$invoice = $db->query("SELECT * FROM invoices WHERE id = $id AND user_id = " . $currentUser->id);
?>
See Also
- What Are Insecure Direct Object References
- Insecure Direct Object Reference Prevention Cheat Sheet
- IDOR Vulnerability in WordPress: 7 Proven Ways to Fix It