IDOR Vulnerability at AddTagToAssets operation name

How it was found

Insecure Direct Object Reference (called IDOR from here) occurs when a application exposes a reference to an internal implementation object. Using this way, it reveals the real identifier and format/pattern used of the element in the storage backend side. The most common example of it (altrough is not limited to this one) is a record identifier in a storage system (database, filesystem and so on). IDOR do not bring a direct security issue because, by itself, it reveals only the format/pattern used for the object identifier. IDOR bring, depending on the format/pattern in place, a capacity for the attacker to mount a enumeration attack in order to try to probe access to the associated objects.

Vulnerable Endpoint:

https://hackerone.com/graphql

Steps to reproduce:

1. Create two h1 accounts as attacker and victim and then create a scope asset respectively
2. Victim create a new custom tag
3. Assign tag to attacker's scope then capture the request
4. You will obtain a request whose the operationName: AddTagToAssets and contains tagId parameter which has a base64 cipher text within
5. If you decode it, the result's format is gid://hackerone/AsmTag/4979xxxx
6. Bruteforce the AsmTagId then replace to your tagId parameter
7. You will obtain 200 OK response status contains the error messages:

{"data":null,"errors":[{"message":"AsmTag does not exist","locations":[{"line":2,"column":3}],"path":["addTagToAssets"],"type":"NOT_FOUND"}]}

8. But no worries, this issue can still be produced if you look at your assets page
9. Successfully to disclose victim's custom tag without any interaction with victim

████████████

Detail about vulnerability and PoC on the attachment video file below.

███

Remediation:

IDOR means that you directly alter a database object by using user submitted data in the query before checking or validating that data. You should first check if the user that submits the request isn't tampering and isn't submitting any ID's that do not belong to his account.

Impact

Lead to disclose all of victim's new custom tags without any interaction with victim.