Insecure Direct Object Reference in MCO Trading Document Fetch

Compliance Impact

The vulnerability allows unauthorized access to sensitive trading documents of other users due to improper authorization checks. This unauthorized disclosure of sensitive information can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls to protect personal and sensitive data from unauthorized access.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the MCO application, specifically in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint.

The application does not properly check if an authenticated user is authorized to access a requested document, allowing users to retrieve documents by supplying a document ID.

Because the document IDs follow predictable patterns, an attacker can guess or enumerate these IDs to access trading documents belonging to other users without permission.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive trading documents belonging to other users.

An attacker who successfully exploits this issue can access confidential information that they should not have access to, potentially leading to privacy breaches or misuse of sensitive data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an Insecure Direct Object Reference (IDOR) in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint, where an attacker can access documents by providing a user-supplied document ID.

To detect this vulnerability on your system or network, you can attempt to access the fetchPdfStatement endpoint with different document IDs while authenticated, to see if documents belonging to other users are accessible.

Commands or tools that can be used include curl or any HTTP client to send requests with varying document IDs and observe if unauthorized documents are returned.

• Example curl command to test access to a document ID: curl -i -H "Authorization: Bearer <token>" "https://<mco-server>/customer/servlet/mco/webapi/trading-document/fetchPdfStatement?documentId=<id>"
• Automate enumeration by scripting requests with sequential or predictable document IDs to check for unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint to only authorized users and implementing proper authorization checks to ensure users can only access their own documents.

If possible, disable or restrict the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint until a patch or fix is applied.

Monitor access logs for unusual or repeated requests with varying document IDs that may indicate exploitation attempts.

Contact the vendor or check for updates or patches addressing this vulnerability, especially for version 25.3.3.1 and potentially other versions.

Useful 0 Not Useful 0