Insecure Direct Object Reference in Attendize Allows Unauthorized Event Data Modification

Executive Summary

An insecure direct object reference vulnerability in Attendize allows authenticated event organizers to inject attendees and orders into events belonging to other accounts. The vulnerability occurs via the postInviteAttendee endpoint, which loads the target event by ID without checking if the event belongs to the authenticated user's account. This enables attackers to modify event data and financial records across different accounts.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized event modifications or attendee injections by reviewing logs for POST requests to /postInviteAttendee with event IDs not belonging to the authenticated user. Look for unexpected financial record changes or duplicate orders across accounts.

Useful 0 Not Useful 0

Impact Analysis

If you are an event organizer using Attendize, an attacker with access to another organizer's account could inject fake attendees or orders into your event. This could lead to financial losses, incorrect attendee records, and reputational damage. For users of the platform, it may result in unauthorized access to event data or financial transactions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of personal data, violating GDPR's data integrity and confidentiality requirements. For organizations handling health data, it may also breach HIPAA's safeguards for protected health information by allowing unauthorized changes to event records.

Useful 0 Not Useful 0

Mitigation Strategies

Update Attendize to the latest commit or apply a patch that scopes event queries to authenticated user accounts. Restrict database access and audit all event and order records for signs of tampering. Disable the postInviteAttendee endpoint if not critical.

Useful 0 Not Useful 0