Member-only story
How a line of code resulted in a $20,000 bug bounty from GitLab
The hidden dangers of numerical IDs
Summary
Web applications have so many different objects, and it’s important to be able to uniquely identify all of these through the use of primary keys. We typically consider numerical IDs to be a good identifier; for example, we could use unique 10-digit number for each user. However, using deterministic IDs can often result in a common vulnerability insecure direct object references (IDOR). In this type of vulnerability, the web app fails to check if the attacker (let’s say user 1111) should be able to view/edit the resources of a victim (let’s say user 2222).
Usually, these vulnerabilities are not in extremely obvious places; most apps try to take IDORs into account, and you probably won’t be able to delete another user’s account from yours using IDORs. But, in places that can be overlooked, or might seem unnecessary to have an access check, there can lie hidden dangers. This is exactly what happen to GitLab when HackerOne user saltyyolk
found a critical IDOR bug, resulting in a $20,000 bug bounty.

The Exploit
I will be going over
saltyyolk
’s summary and report provided at HackerOne. Please read the original summary for an in-depth technical analysis.