Insecure direct object reference exposes other customers' invoices
- Affected asset
- GET /api/v2/invoices/{id} on app.example.com.au
- Rating
- High Likely 4 × High 4 = 16
Description
The invoice endpoint returns any invoice by its identifier without checking that it belongs to the authenticated user. Because identifiers are sequential, an attacker with one account can retrieve every invoice in the system by incrementing the number.
Evidence
GET /api/v2/invoices/1042 HTTP/1.1
Host: app.example.com.au
Authorization: Bearer eyJhbGciOi... # a standard customer's token
HTTP/1.1 200 OK
{ "id":1042, "customer":"Northwind Pty Ltd",
"abn":"51 xxx xxx xxx", "total":"12,480.00" }
# 1042 belongs to a different customer than the token holder
A standard customer's token retrieved an invoice belonging to another customer, including their ABN and billing detail.
Impact
Every customer's billing records, including business names, ABNs and amounts, can be read by any authenticated user. A single script would retrieve the entire invoice history of the platform. Exposure on this scale is what the Notifiable Data Breaches scheme exists for, and it is invisible to a scanner because the request itself is well-formed.
Remediation
Enforce an ownership check on every object lookup: the invoice must belong to the authenticated user, or to an account they are authorised to view. Apply the check server-side on every endpoint, not only in the user interface, and consider identifiers that are not guessable as defence in depth.