Insecure Direct Object Reference on in-scope .mil website

How it was found

Summary: A web form in a .mil website doesn't implement restriction against multiple failed attempts to place an ID in order to obtain users information or cancel an ongoing process. Description: Websites https://█████████/appointment/lookup.aspx?a=f and https://██████████/appointment/lookup.aspx?a=c are sites where users could find or cancel respectively an appointment made previously. If an attacker (or skript-kiddie) wants to cancel an appointment from legit users, he/she just need to pick a random last name and then launch a dictionary or brute force attack against the "Confirmation Number" form field. If the attacker has success in his journey could cancel appointments and even wrong could obtain some personal information about users.

Impact

High

Step-by-step Reproduction Instructions

1. Configure a web proxy capable of intercept HTTPS requests (like Burp Suite)
2. Configure a web browser to use the parameters of the proxy set in the previous step
3. Visit the website site https://█████████/appointment/lookup.aspx?a=f
4. Type a random last name (I used Smith) and type a random number in the other field
5. Click on the Next>> button and intercept that request.
6. Make a right click in the proxy software and chose "Send to Intruder"
7. Since Burp Intruder uses a Request made previously to the website, then it uses the current information like Referer header, Cookie, VIEW_STATE, Last Name, now you just have to go to Positions tab and click on clear button (to clear selected fields that Intruder recognized automatically) and make a double click on the value of the TbPin parameter, next click on the Add button in order to set that field as the target ███████
8. Now go to Payloads tab, down to Payload Options [Simple list] and set a wordlist having 8 long hex characters and launch the test clicking on the Start Attack button located at right top corner.
9. A new window instance of Burp Intruder will open and you'll see the attacker software is making requests and there's no interruption in its task due to prevention measures against brute force attacks. █████████

Note: For my tests I created previously some two Appointment Numbers (30AC5814 and 9D1D10C7) and I have added them to the wordlist, thus I don't gotten any user legit information. ███████

Product, Version, and Configuration (If applicable)

/*****/

Suggested Mitigation/Remediation Actions

Despite the Appointment Number is 8 characters long, 0 to 9 and A to F (hex characters), now a day with cloud computer information processing capabilities it could be guessed in minutes. You should implement some restriction process against failed attempts, like:

1. Set a captcha system after 3 or 5 failed attempts
2. Set the same Length in the response pages either the requested Appointment Number is right or not (As suggestion, you can put blank spaces in the body of fail attempt in order to be the same with a right attempt) ███████

PS. Since this attack could leak some personal information like Name, Telephone number and E-mail apart of delaying a process (canceling an appointment), I hope you should be consider it as High impact. Thanks!