IDOR Leading to Plaintext SFTP Credential Disclosure and Unauthorized SFTP Access
An Insecure Direct Object Reference (IDOR) vulnerability in the organization API allows authenticated users to manipulate the identifier parameter and retrieve plaintext SFTP credentials belonging to other users or organizations, potentially leading to unauthorized access to sensitive files stored on the SFTP server.
🎯 Target Overview
The application under review includes a feature enabling administrators to import files from an SFTP server. This operation requires authentication to the SFTP service using valid credentials tied to a specific organizational account.
The application's workflow involves obtaining SFTP credentials via an internal API endpoint. Once retrieved, these credentials are used to establish a connection to the SFTP server, allowing access to files within the designated user directory.
Given the reliance on dynamically retrieved credentials from the backend, securing the API endpoints that provide these credentials is paramount.