Spring Boot IDOR (CWE-639) in /updateuser endpoint: Admin Account Takeover PoC

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: VULN-1 — IDOR (Insecure Direct Object Reference) Location: endpoint in Type: CWE-639 (Authorization Bypass via User-Controlled Key) CVSS 3.1: 8.8 (High) Status: Confirmed (Dynamically Verified) Nature: The endpoint directly accepts a parameter from the HTTP request without verifying whether the currently authenticated user is authorized to modify the target user. Any authenticated user (including low-privilege ) can pass an arbitrary to modify another user's profile, even an administrator account, leading to complete account takeover. Impact Scope Any authenticated user can modify the profile (username, email, password, address) of any user The password of an administrator ( ) can be modified, thereby gaining full control over the entire e-commerce system Default credentials (stored in plaintext in ), resulting in a very low barrier to exploitation Vulnerable Code UserController.java — UserService.java — Attack Chain Dynamic PoC Verification Steps PoC script: (reproducible, self-resetting) Remediation Add an authorization check before updating the user profile, ensuring users can only modify their own profiles, while administrators can modify any user: Additional Notes Password Encoder: The application uses (configured in ), and passwords are stored as BCrypt hashes. The IDOR bypasses this protection because the attacker supplies the raw password through the legitimate encoding path. CSRF Protection: Spring Security's CSRF is enabled, but CSRF only defends against cross-site attacks; it does not block IDOR within the same session. Default Credentials: and in are both in plaintext, making exploitation extremely simple. Remediation PR: PR #174 (committed by ked308, existing tests verified to pass).

Goal Reached Thanks to every supporter — we hit 100%!

Spring Boot IDOR (CWE-639) in /updateuser endpoint: Admin Account Takeover PoC

More from this source