IDOR — دسترسی غیرمجاز به منابع کاربران دیگر

IDOR (Insecure Direct Object Reference) is the #1 vulnerability in OWASP Top 10 2021 under Broken Access Control.

## Vulnerability Overview
IDOR occurs when an application uses user-controllable input to access objects directly without verifying that the requesting user has authorization. By simply changing an ID in a URL or API request, attackers can access other users' data.

## Technical Details
- **Vulnerable Pattern:** /api/users/1234/profile → change to /api/users/1235/profile
- **Root Cause:** Missing server-side authorization checks; trusting client-supplied identifiers
- **Variants:** Numeric ID manipulation, GUID prediction, parameter pollution, path traversal IDOR
- **Common Locations:** REST API endpoints, file download URLs, invoice/order IDs, user profile endpoints

## Impact Assessment
- Mass data exfiltration of all user records
- Account takeover by modifying other users' email/password
- Financial fraud via order/invoice manipulation
- PII exposure (names, addresses, payment info)
- Privilege escalation by accessing admin endpoints

## Real-World Examples
- JetBrains TeamCity CVE-2024-27198: Authentication bypass via IDOR in REST API
- Exposed millions of user records in major platforms (Uber, Facebook historical cases)

## Indicators of Compromise
- Sequential ID enumeration in access logs
- Unusual cross-user data access patterns