Insecure Direct Object Reference in GeoPulse Places API

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in GeoPulse 1.5.0 through 2.3.0. It allows authenticated users to read other users' private locations by exploiting predictable IDs in the GET /api/v1/places/geocoding/{id} endpoint. Attackers can enumerate sequential IDs to retrieve sensitive data like custom place names, city, country, coordinates, and bounding boxes from other users' location histories.

Useful 0 Not Useful 0

Detection Guidance

To detect this IDOR vulnerability, monitor API logs for repeated GET requests to /api/v1/places/geocoding/{id} with sequential numeric IDs. Check for unauthorized access patterns where users retrieve location data not belonging to them. Use tools like Burp Suite or OWASP ZAP to intercept and manipulate API requests, testing for improper authorization checks.

Useful 0 Not Useful 0

Impact Analysis

If you use GeoPulse 1.5.0 through 2.3.0, an attacker with an authenticated account could access your private location data, including custom place labels, coordinates, and city/country information. This could expose your location history and personal place names to unauthorized users. The attack requires only a standard user role and no special privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with privacy regulations like GDPR and HIPAA by exposing users' location data without authorization. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related location information. The unauthorized access to private locations may violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GeoPulse to the latest patched version where the fix has been applied. If patching is not possible, implement server-side checks in the PlaceDetailsService to verify that the requested location ID belongs to the authenticated user before returning data. Restrict API access to authenticated users only and log suspicious enumeration attempts.

Useful 0 Not Useful 0