Insecure direct object reference

Definition

Insecure direct object reference, or IDOR, is a type of security vulnerability where an application provides direct access to an internal implementation object. This occurs when user supplied input is used directly as a reference to an object without proper access control checks. It allows an attacker to bypass authorization and access resources they should not be able to see or modify. For instance, an attacker could change a user ID in a URL to view another user's account details. This differs from broken access control in that IDOR specifically involves direct object manipulation rather than broader permission issues. IDOR is a common topic on exams like CompTIA Security+, CySA+, and CISSP.

Related terms

• IDORIDOR is a security flaw where an application exposes internal objects without proper authorization, allowing attackers to access data.
• BGP hijackingBGP hijacking misdirects internet traffic by falsely claiming IP address ownership, enabling data interception and disruption.
• XML external entityXXE is a vulnerability where XML parsers fetch external data, potentially exposing sensitive files or enabling SSRF attacks.
• Side-channel attackA side-channel attack exploits physical information leakage, like power consumption or timing, to compromise systems.

Related course suggestions

• AI+ Ethical Hacker
• AI+ Security Level I

Related PathKey™ guides

• Advanced in AI Security Management (AAISM)
• AI+ Ethical Hacker
• AI+ Security Level I