Authenticated IDOR in waynboot-mall Allows Address Manipulation

Executive Summary

This vulnerability is an insecure direct object reference in waynboot-mall through version 2.0.0. It affects the AddressController component and allows authenticated members to modify or delete other members' shipping addresses. Attackers can exploit this by guessing auto-increment address IDs and sending specific POST or DELETE requests to overwrite or remove saved addresses of other users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /address and DELETE requests to /address/{addressId} endpoints. Check for unusual patterns like sequential or predictable address IDs being accessed by non-admin users. Inspect server logs for unauthorized modifications or deletions of shipping addresses.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of waynboot-mall, an attacker could change or delete your shipping addresses without your consent. This could disrupt your orders, cause delays in deliveries, or even lead to lost packages. The impact is limited to address manipulation but can cause inconvenience and potential financial loss.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data integrity and user privacy principles under GDPR and HIPAA. GDPR requires protecting personal data, and unauthorized modifications to shipping addresses could be seen as a breach. HIPAA requires safeguarding protected health information, which could be indirectly affected if addresses are linked to health-related orders.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update waynboot-mall to the latest version beyond 2.0.0. Implement access controls to restrict address modifications to only the owner. Disable auto-increment IDs for addresses and use random, non-sequential identifiers. Add rate limiting and authentication checks for sensitive endpoints.

Useful 0 Not Useful 0