Bug #22305
[External Audit Findings][MLEB, iOS, Android] Insecure Direct Object Reference Vulnerability (IDOR)
| Status: | Pending PROD | Start date: | 29 July 2025 | |
|---|---|---|---|---|
| Priority: | High | Due date: | ||
| Assignee: | yap chekying | % Done: | 0% | |
| Category: | - | Spent time: | - | |
| Target version: | - |
Description
Issue:
The IDOR vulnerability occurs when an app exposes internal object references without access control. This allows attackers to access data by manipulating input values. If exploited, IDOR may lead to serious business data breaches.
Recommendation from pentester:
Developers must implement proper access control so that users can only access information or perform actions within a session that are defined by the access rights assigned to that session.
Please refer to attached excel for details.
History
#1 Updated by Hao Ter Tai 18 days ago
238,070
1/8/2025 [External Audit Findings][MLEB] Insecure Direct Object Reference Vulnerability (IDOR)
Issue:
The IDOR vulnerability occurs when an app exposes internal object references without access control. This allows attackers to access data by manipulating input values. If exploited, IDOR may lead to serious business data breaches.
Solution:
FE will store alias id and pass back to BE for BE checking
#2 Updated by Tan Hi Ann 14 days ago
- Status changed from New to Resolved
RC: The IDOR vulnerability occurs when an app exposes internal object references without access control. This allows attackers to access data by manipulating input values. If exploited, IDOR may lead to serious business data breaches.
Solution: BE uses aliasId passed from FE and compare with self constructed aliasId to ensure the same device and user
#3 Updated by Tan Hi Ann 14 days ago
- Assignee changed from Tan Hi Ann to yap chekying
#4 Updated by yap chekying 13 days ago
- File Android-old app to new app.mp4 added
- File Android-Fresh install, binded 2.mp4 added
- File Android-Fresh install, binded 1.mp4 added
- File Android-Fresh install, not bind.mp4 added
- File iOS-old app to new app.mp4 added
- File iOS-Fresh install, binded.mp4 added
- File iOS-Fresh install, not bind.mp4 added
- File RE OCBC Business Mobile app Audit Findings - July 2025.msg added
- Status changed from Resolved to Pending UAT
#5 Updated by yap chekying 11 days ago
- Subject changed from [External Audit Findings][MLEB] Insecure Direct Object Reference Vulnerability (IDOR) to [External Audit Findings][MLEB, iOS, Android] Insecure Direct Object Reference Vulnerability (IDOR)
#6 Updated by yap chekying 11 days ago
- Status changed from Pending UAT to Pending PROD