Attacking GraphQL — Insecure Direct Object Reference (IDOR)
Introduction
Insecure Direct Object Reference (IDOR) vulnerabilities occur when a web application directly exposes object references, like database entries or files, without proper access controls, enabling unauthorized users to access, modify, or retrieve sensitive information. This guide demonstrates how to exploit an IDOR vulnerability in a GraphQL API to obtain sensitive data such as admin credentials, highlighting the critical need for implementing strong access controls.
Step 1: Access the Target GraphQL Website
Open your web browser and navigate to the target URL. Note that the IP address may vary:
Use the provided credentials to log in:
- Username:
htb-stdnt - Password:
AcademyStudent!
Step 2: Access the GraphQL Endpoint
After logging in, navigate to the GraphQL endpoint at:
http://94.237.54.201:42665/graphql
Note: This endpoint will allow you to execute GraphQL queries to interact with the backend API.
Step 3: Retrieve Information About the “UserObject” Type
In the GraphQL interface, enter the following Graph_i_QL query to identify the fields within the “UserObject” type:
{
__type(name: “UserObject”) {
name
fields {
name
type {
name
kind
}
}
}
}
Explanation:
__type(name: "UserObject"): Fetches details about the “UserObject” type.name: Retrieves the name of the type.fields: Lists all fields within the “UserObject.”type { name, kind }: Provides the name and kind (e.g., SCALAR, OBJECT) of each field’s data type.
Summary: This command examines the structure of the “UserObject,” showing all its fields and their data types.
Step 4: Extract Admin User Credentials Using GraphQL Query
Use the following query to extract credentials for the admin user:
{
user(username: “admin”) {
username
password
}
}
Explanation:
user(username: "admin"): Fetches details for the user with the username “admin.”username: Retrieves the admin’s username.password: Retrieves the admin’s password.
Summary: This command fetches the username and password details for the “admin” user from the GraphQL API.
Step 5: Obtain and Validate the Flag
The response from the above query should display the admin’s credentials along with the flag:
HTB{79ebbbceXXXXXXXXXXXXXXXXXXXXXXXX}
This output confirms that the attack was successful, and the system is vulnerable to IDOR exploitation.
Important Note: Accessing data without authorization is illegal in real-world scenarios. Always perform such tests only in a controlled, ethical hacking environment.
Step 6: Submit the Flag to Hack The Box (HTB)
Conclusion
This guide has shown how to exploit an Insecure Direct Object Reference (IDOR) vulnerability in a GraphQL API, allowing unauthorized access to sensitive data such as admin credentials. This emphasizes the need for robust access controls to protect APIs from such vulnerabilities. Developers should enforce proper authorization checks and validate user permissions to prevent unauthorized data exposure.
By understanding these weaknesses, security professionals can better defend systems against IDOR attacks, ensuring that sensitive information remains secure.
References:
- Hack The Box Academy Course: Attacking GraphQL — A course that covers techniques for exploiting vulnerabilities in GraphQL APIs.
- Hack The Box Academy Course: Web Attacks — A course focused on identifying and exploiting common web application vulnerabilities.
- GraphQL Official Documentation on Global Object Identification — The official guide explaining how to use global object identification in GraphQL for securing and retrieving data.
