Summary
Yshopmall through version 2.0.0 contains an insecure direct object reference in its member address API, allowing authenticated members to access address records belonging to other users. By manipulating sequential address identifiers, an attacker may disclose, modify, reassign, or delete shipping information.
Yshopmall through version 2.0.0 contains an insecure direct object reference in its member address API, allowing authenticated members to access address records belonging to other users. By manipulating sequential address identifiers, an attacker may disclose, modify, reassign, or delete shipping information.
Affected context
The vulnerability occurs in Yshopmall member address functionality when API endpoints identify records using client-supplied address IDs without consistently verifying that the requesting member owns the referenced record. Risk is increased where address identifiers are predictable and authorization checks are missing or incomplete across detail, edit, and delete operations.
The vulnerability occurs in Yshopmall member address functionality when API endpoints identify records using client-supplied address IDs without consistently verifying that the requesting member owns the referenced record. Risk is increased where address identifiers are predictable and authorization checks are missing or incomplete across detail, edit, and delete operations.
Exploit preconditions
- Attack surface: Member address API endpoints, including detail, edit, and delete operations
- Required access: A valid authenticated member account
- Trigger point: Supplying another member's address identifier to an address operation
- Why exploitation is possible: Object-level authorization does not adequately bind the requested address record to the authenticated member
- Attack surface: Member address API endpoints, including detail, edit, and delete operations
- Required access: A valid authenticated member account
- Trigger point: Supplying another member's address identifier to an address operation
- Why exploitation is possible: Object-level authorization does not adequately bind the requested address record to the authenticated member
Why this happens
The underlying flaw is an authorization failure in which the application accepts a direct object reference from the client and retrieves or changes the referenced record without enforcing ownership or an equivalent access policy. Predictable identifiers can make records easier to target, but the core issue is the missing object-level authorization check, mapping to CWE-639: Authorization Bypass Through User-Controlled Key.
The underlying flaw is an authorization failure in which the application accepts a direct object reference from the client and retrieves or changes the referenced record without enforcing ownership or an equivalent access policy. Predictable identifiers can make records easier to target, but the core issue is the missing object-level authorization check, mapping to CWE-639: Authorization Bypass Through User-Controlled Key.
Potential impact
- Exposure of recipient names, telephone numbers, and shipping addresses
- Unauthorized modification or reassignment of member address records
- Deletion of legitimate shipping addresses
- Privacy violations and possible fraud involving delivery information
- Disruption of member account and order fulfillment workflows
- Exposure of recipient names, telephone numbers, and shipping addresses
- Unauthorized modification or reassignment of member address records
- Deletion of legitimate shipping addresses
- Privacy violations and possible fraud involving delivery information
- Disruption of member account and order fulfillment workflows
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the object level for every address operation.
Common defensive patterns include:
- Deriving the owning member from the authenticated session rather than trusting client-supplied ownership data
- Verifying that each referenced address belongs to the requesting member before reading, editing, or deleting it
- Applying the same authorization policy consistently across detail, update, and deletion endpoints
- Using opaque or non-sequential identifiers as a defense-in-depth measure, without treating them as authorization
- Returning minimal error details and limiting exposure of personal information
- Applying least-privilege database access and logging sensitive object-level authorization failures
Mitigation generally focuses on enforcing authorization at the object level for every address operation.
Common defensive patterns include:
- Deriving the owning member from the authenticated session rather than trusting client-supplied ownership data
- Verifying that each referenced address belongs to the requesting member before reading, editing, or deleting it
- Applying the same authorization policy consistently across detail, update, and deletion endpoints
- Using opaque or non-sequential identifiers as a defense-in-depth measure, without treating them as authorization
- Returning minimal error details and limiting exposure of personal information
- Applying least-privilege database access and logging sensitive object-level authorization failures
How teams detect issues like this
Organizations commonly detect IDOR risks through:
- Static analysis and code review rules that flag direct database lookups using request parameters
- Review of controller and service methods for ownership checks before read, update, and delete operations
- API tests that substitute another authenticated user's object identifiers
- Dynamic testing for sequential identifier enumeration and cross-account access
- Policy enforcement requiring centralized object-level authorization middleware or service-layer checks
- Monitoring for repeated requests across address identifiers and unusual cross-account access patterns
Organizations commonly detect IDOR risks through:
- Static analysis and code review rules that flag direct database lookups using request parameters
- Review of controller and service methods for ownership checks before read, update, and delete operations
- API tests that substitute another authenticated user's object identifiers
- Dynamic testing for sequential identifier enumeration and cross-account access
- Policy enforcement requiring centralized object-level authorization middleware or service-layer checks
- Monitoring for repeated requests across address identifiers and unusual cross-account access patterns
