From adb1f70e0b6c230beaa227b8ecda5c155f7dfb69 Mon Sep 17 00:00:00 2001 From: snow Date: Mon, 10 Aug 2026 00:23:36 -0700 Subject: [PATCH] Ignore IDOR level 4 encoded role cookie Signed-off-by: snow --- .../vulnerability/idor/IDORVulnerability.java | 2 +- .../idor/IDORVulnerabilityTest.java | 22 +++++-------------- 2 files changed, 7 insertions(+), 17 deletions(-) diff --git a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java index d23f59e2e..011cf1159 100644 --- a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java +++ b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java @@ -204,7 +204,7 @@ public ResponseEntity> level4( if (actualToken != null) { User decodedUser = idorLoginService.decodeToken(actualToken); int tokenUserId = decodedUser.getUserId(); - String role = cookieRole != null ? decodeBase64(cookieRole) : decodedUser.getRole(); + String role = decodedUser.getRole(); if (id == null) { id = tokenUserId; diff --git a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java index 12b3b1cbd..d1bee231c 100644 --- a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java +++ b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java @@ -100,7 +100,7 @@ void level3_ShouldAllowRoleEscalationWhenRoleCookieIsAdmin() { } @Test - void level4_ShouldAllowOpaqueIdAccess() { + void level4_ShouldRejectEncodedRoleEscalation() { String encodedRole = java.util.Base64.getUrlEncoder() .withoutPadding() @@ -112,19 +112,14 @@ void level4_ShouldAllowOpaqueIdAccess() { User decoded = new User(); decoded.setUserId(1); decoded.setRole("USER"); - User bob = new User(2, "Bob", 60000, "USER"); when(idorLoginService.decodeToken(escalatedToken)).thenReturn(decoded); - when(jdbcTemplate.query( - anyString(), - any(Object[].class), - any(org.springframework.jdbc.core.RowMapper.class))) - .thenReturn(Arrays.asList(bob)); ResponseEntity> response = idor.level4(escalatedToken, encodedRole, 2); - assertTrue(response.getBody().getIsValid()); + assertFalse(response.getBody().getIsValid()); + assertEquals("Access Denied - Insufficient privileges", response.getBody().getContent()); } @Test @@ -173,7 +168,7 @@ void level3_ShouldRejectInvalidToken() { } @Test - void level4_ShouldAllowAccessToAnyOpaqueIdRegardlessOfRole() { + void level4_ShouldRejectCrossUserAccessWithEncodedAdminRole() { String userToken = java.util.Base64.getEncoder() .encodeToString("{\"userId\":1,\"role\":\"USER\"}".getBytes()); @@ -185,19 +180,14 @@ void level4_ShouldAllowAccessToAnyOpaqueIdRegardlessOfRole() { User decoded = new User(); decoded.setUserId(1); decoded.setRole("USER"); - User bob = new User(2, "Bob", 60000, "USER"); when(idorLoginService.decodeToken(userToken)).thenReturn(decoded); - when(jdbcTemplate.query( - anyString(), - any(Object[].class), - any(org.springframework.jdbc.core.RowMapper.class))) - .thenReturn(Arrays.asList(bob)); ResponseEntity> response = idor.level4(userToken, encodedRole, 2); - assertTrue(response.getBody().getIsValid()); + assertFalse(response.getBody().getIsValid()); + assertEquals("Access Denied - Insufficient privileges", response.getBody().getContent()); } @Test