CISA warns on IDOR vulnerabilities in web applications
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
ACSC, CISA, and NSA issued joint advisory on insecure direct object reference vulnerabilities enabling data breach at scale.
The Australian Signals Directorate, U.S. Cybersecurity and Infrastructure Security Agency, and National Security Agency released a joint cybersecurity advisory warning about insecure direct object reference (IDOR) vulnerabilities in web applications and APIs. IDOR vulnerabilities are access control flaws that allow attackers to access, modify, or delete sensitive data by manipulating identifiers in requests when proper authentication and authorization checks are absent. These vulnerabilities are particularly dangerous because they are common, difficult to prevent outside the development lifecycle, and can be exploited at scale using automated tools.
The advisory documents real-world impact: a 2021 stalkerware incident exposing phone data including texts, call records, photos, and geolocation from hundreds of thousands of devices; a 2019 financial services breach exposing over 800 million personal financial files; and a 2012 communications sector breach affecting over 100,000 mobile device owners. Four exploitation patterns are identified: body manipulation via POST request tampering, URL tampering, cookie ID manipulation, and HTTP/JSON request interception and modification. Vulnerabilities manifest across four types: horizontal (same-privilege unauthorized access), vertical (higher-privilege access), object-level (unauthorized modification/deletion), and function-level (unauthorized action access).
Mitigations for developers include implementing secure-by-design and secure-by-default principles, using automated code analysis, indirect reference maps with UUIDs/GUIDs instead of exposed identifiers, deny-by-default access controls, input validation (syntactic and logical), CAPTCHA limiting, memory-safe languages, automated testing and fuzz testing, DAST tools, supply chain due diligence, and vulnerability disclosure programs. End-user organizations should exercise vendor due diligence, apply patches immediately, log and alert on tampering attempts, centralize logging via SIEM, maintain incident response plans, conduct regular penetration testing on internet-facing applications, use web application firewalls and data loss prevention tools, and establish vulnerability disclosure programs.
Mentioned in this report
Detection guidance
Fuzzing or Enumeration Tool Requests Against Object-Identifier Endpoints
Web server requests from known fuzzing/enumeration tool user agents against URLs carrying object identifiers (id/uid/account parameters or numeric path segments), which is typical automated IDOR enumeration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fuzzing or Enumeration Tool Requests Against Object-Identifier Endpoints
id: 74e8d375-d44b-5cb4-b147-f7320406f92d
status: experimental
description: Detects web requests from fuzzing and enumeration tool user agents against
endpoints that reference objects by identifier (query parameters such as id, uid,
userid, account, or numeric path segments). This is consistent with automated IDOR
exploitation by iterating identifiers at scale. Generalises on tool behaviour against
ID-bearing URLs, not specific hosts or IDs.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-208a
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_ua:
cs-user-agent|contains:
- ffuf
- wfuzz
- gobuster
- feroxbuster
- dirbuster
selection_id_query:
cs-uri-query|contains:
- id=
- uid=
- userid=
- user_id=
- account=
- accountid=
- docid=
- orderid=
selection_id_path:
cs-uri-stem|re: /[A-Za-z_-]+/[0-9]{1,12}(/|$)
condition: selection_ua and 1 of selection_id_*
falsepositives:
- Authorized penetration tests or DAST scans against the web application
- Internal QA teams running fuzzers against staging endpoints
level: medium
author: Vorant
Denied Responses on Object-Identifier URLs Indicative of IDOR Probing
Web server 401/403 responses to requests for resources addressed by numeric identifiers in the path or an ID query parameter. A high volume from one source suggests identifier tampering; apply a per-source threshold in the SIEM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Denied Responses on Object-Identifier URLs Indicative of IDOR Probing
id: e2968175-74c6-5ca5-a63b-e4c4f5b5c171
status: experimental
description: Detects HTTP 401/403 responses to requests for resources addressed by
numeric object identifiers in the path or id-style query parameters. A single hit
is weak; alert or aggregate in the SIEM when one client generates many such denials
in a short window (authorization failures during identifier tampering).
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-208a
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_status:
sc-status:
- 401
- 403
selection_path:
cs-uri-stem|re: /(users?|accounts?|customers?|orders?|invoices?|documents?|files?|profiles?|records?)/[0-9]{1,12}(/|$)
selection_query:
cs-uri-query|contains:
- id=
- uid=
- userid=
- user_id=
- accountid=
condition: selection_status and 1 of selection_p* or (selection_status and selection_query)
falsepositives:
- Users with expired sessions clicking bookmarked record links
- Monitoring or health-check tools requesting protected object URLs without credentials
level: low
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-208a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs