# VULNERABILITY REPORT: Insecure Direct Object Reference (IDOR) ## EXECUTIVE SUMMARY An IDOR vulnerability in the order processing API allowed users to view and modify the shipping details of orders belonging to other users. ## TECHNICAL DETAILS **Endpoint:** `PUT /api/orders/{order_id}/shipping` The API endpoint used the `order_id` from the URL path to identify the order record but failed to verify if the currently authenticated user was the owner of that order. By iterating through sequential order IDs, an attacker could access arbitrary order details. ### Attack Scenario 1. User A places an order (ID: 1001). 2. User A intercepts the request to update shipping. 3. User A changes the ID to 1002 (User B's order). 4. The server accepts the request and updates User B's shipping address to User A's location. ## REMEDIATION - Implement proper access control checks on every API endpoint. - Verify that `current_user.id == order.user_id` before processing the request. - Use unpredictable UUIDs instead of sequential integers for IDs. ## TIMELINE - **2024-09-30**: Reported. - **2024-10-01**: Critical priority assigned. - **2024-10-02**: Hotfix deployed.