IDOR — Unauthorized Access to Other Users’ CV Documents

Summary#

An IDOR/BOLA vulnerability was identified in the document download functionality. An authenticated user could download another user's CV by modifying the file_id parameter in the download request.

The application did not properly verify that the requested file belonged to the currently authenticated user.

Steps to Reproduce#

1. Create two separate accounts: Account A and Account B.
2. Log in to Account A and navigate to My Documents.
3. Open a CV/document belonging to Account A.
4. Intercept the document download request using Burp Suite:

GET /api/documents/000000/download

5. Inspect the subsequent request and identify the file_id parameter: