Bug 2169751 - PT: ROS: Insecure Direct Object Reference (IDOR) - Rating
Summary: PT: ROS: Insecure Direct Object Reference (IDOR) - Rating
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2169460
TreeView+ depends on / blocked
 
Reported: 2023-02-14 15:10 UTC by juneau
Modified: 2023-07-07 08:28 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description juneau 2023-02-14 15:10:20 UTC
Description
Authorization defines the concept of controlling access to resources. Only those users or user profiles  that  need  access  to  information  should  have  access  to  it.  Incorrect  authorization management can allow users to access restricted functionalities, to which only a certain group of users should have access, or access to other users private information. 
During this pentest, it has been detected that in the rating functionally, more concretely,  /api/ros/v1/rating, is possible to modify the rating of the system that doesn’t belong to that user.

Impact
This vulnerability allows users to modify the rating of systems from other organizations, and as reported in the previous pentest (RHIROS-400), also enumerate systems from other organizations. Rating is altered therefore this vulnerability impacts confidentiality and integrity.

Recommendations
To avoid the risk associated with this vulnerability, it is recommended to implement an adequate authorization mechanism within the overall service, especially in the private part, checking the access rights of the user associated with the session before accessing any resource or information.

References
https://cwe.mitre.org/data/definitions/285.html
https://portswigger.net/web-security/access-control/idor


Note You need to log in before you can comment on or make changes to this bug.