Description

Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T14:16:58.197Z",
  "pubdate": "2026-08-13T14:16:58.197Z",
  "executiveSummary": "An Insecure Direct Object References vulnerability has been identified in Do Lasso versions <= 358. This security flaw allows unauthenticated remote actors to access, manipulate, or exfiltrate unauthorized data objects by directly supplying predictable or sequential identifiers within application requests.\nThe vulnerability directly impacts the confidentiality and integrity of the affected Do Lasso deployment. Because the flaw is exploitable without prior authentication, external malicious actors can interact directly with internal data resources intended to be restricted. This exposes sensitive application data and broadens the attack surface significantly.\nRisk implications include unauthorized data exposure, potential privilege escalation, and unauthorized state modification depending on the backend implementation of the referenced objects. The primary prerequisite for exploitation is network connectivity to the vulnerable Do Lasso instance and the ability to craft HTTP requests targeting insecure object references.",
  "technicalDetails": "The vulnerability exists due to a failure in the Do Lasso application logic to properly validate user authorization prior to fulfilling requests for specific data objects. Specifically, the vulnerable component processes incoming requests referencing internal database keys, file paths, or resource identifiers without verifying whether the requesting session possesses the necessary access privileges.\nThe root cause stems from missing access control checks at the controller or service layer when handling direct object references. When an unauthenticated actor supplies an altered identifier parameter within the request query string, POST body, or URL path, the application retrieves and returns the corresponding resource without enforcing session validation or ownership verification.\nThe attack flow proceeds as follows: First, the unauthenticated attacker probes the Do Lasso application to identify endpoints that accept resource identifiers as parameters. Next, the attacker crafts an HTTP request modifying the target identifier to point to an unauthorized record or file. The Do Lasso server processes the request, bypasses authorization logic due to the absence of access control checks, and returns the requested data payload directly to the attacker.\nNetwork exposure for this vulnerability is remote, as the vulnerable endpoints are accessible over the network without requiring authentication credentials. Affected versions include Do Lasso 358 and all prior iterations. Post-exploitation impact encompasses unauthorized data harvesting, exposure of restricted backend resources, and potential manipulation of application data structures depending on whether the insecure direct object reference supports write operations."
}