What vulnerabilities other than directory traversal come under IDOR?

Question

The most common vulnerability in the OWASP category Insecure direct object reference is directory traversal. What are the other vulnerabilities which fall into this category?

Answer 1

It's important to understand why OWASP classifies directory traversal as IDOR: The parameter that is accepted by the application is a direct reference to a file (instead of an indirect reference which for example points to a database entry, which in turn points to a file). By passing a different direct reference, an attacker can read arbitrary files.

CWE - which is more fine-grained than the OWASP Top 10 - for example uses a different classification:

The "Insecure Direct Object Reference" term, as described in the OWASP Top Ten, is broader than this CWE because it also covers path traversal (CWE-22). Within the context of vulnerability theory, there is a similarity between the OWASP concept and CWE-706: Use of Incorrectly-Resolved Name or Reference.

Some would classify open redirects as IDOR (although OWASP doesn't as it's covered under Unvalidated Redirects and Forwards)

IODR is basically an authorization problem.

The most common other example is a direct reference to database indices. For example, you have a functionality which shows private message:

id = [userinput];
message = getMessage(id);
showMessage(message);

function getMessage(id) {
    return query("SELECT message FROM messages WHERE id = ?", id);
}

The idea is that each user can only read their own messages. But because the ids are direct references to the message, and because there is no authorization check, an attacker can read messages of all users. Note that proper authorization alone would fix the problem, but so would using indirect references (ie each user has messages with id 1 to x, so there is no possibility of accessing other messages).