A pentester found an IDOR in our statements API in 10 minutes. The fix was boring
Last quarter an external pentest found that any logged-in customer could download any other customer's account statement. It took the tester around 10 minutes. I want to share it because the bug was very ordinary, and ordinary bugs are the ones that survive reviews. The endpoint was GET /api/statements/{id} . It checked that the request had a valid session. It did not check that the statement belonged to the…