The US Department of Defense has patched a serious vulnerability affecting its internal network that would have allowed threat actors to compromise DOD accounts by modifying some parameters in web requests sent to DOD servers.
The vulnerability was discovered by Jeff Steinburg, a security researcher at the US security firm Silent Breach, privately reported, and patched through the DOD's Vulnerability Disclosure Program (VDP).
The issue received a severity rating of “Critical (9 ~ 10)” because the bug required minimal technical skills from the attacker to exploit and hijack any DOD account.
The researcher won the “Researcher of the Month” award for the bug he discovered in DOD accounts.
While some details about the bug were revealed today, a full report on the US Department of Defense (DOD) network security protections is not yet available.
According to this summary report, the bug was categorized as a Secure Direct Object Reference (IDOR) vulnerability, a bug where an application lacks security checks , allowing hackers to modify some parameters without additional authentication checks.
In the case of DOD, the flaw would allow an attacker to take a legitimate web request sent to a DOD website, modify the user ID and username parameters, and the DOD website would allow the attacker to change the password of the DOD account (any user) – which would allow hackers to break into accounts and later compromise the DOD network.
Today, IDOR errors are considered easy to find due to the abundance of automated tools that reveal them in a less time-consuming process.
DOD fixed the bug by adding a user session mechanism to the DOD accounts system, preventing attackers from modifying parameters without authenticating to the site first.
Source: zdnet.com
