A new static analysis module for Python has been developed to detect Insecure Direct Object Reference (IDOR) vulnerabilities. Unlike traditional DAST tools, which may struggle with complex SPA architectures or inefficient crawlers, this approach uses mathematical logic to track the relationship between user identifiers, database objects, and authorization checks.
The core of the module operates in three layers: identifying request handlers, building a protocol of data flow and checks, and evaluating the final verdict. It currently supports Django, Django REST Framework, Flask, and FastAPI. The system utilizes a labeling method called SIAOD to distinguish between user inputs, attacker-selected identifiers, and object references.
The tool distinguishes between simple user input and identifiers used to select specific database records. By tracking whether an attacker-selected ID reaches a data fetch operation without a corresponding authorization check that links the object to the current user, the module reduces false positives compared to heuristic-based approaches.
The developer compared this implementation against existing solutions like Guardmarly and OpenAPI-based analysis. While other tools often rely on broad heuristics or lack context regarding object ownership, this module specifically verifies if an authorization check dominates the execution path and correctly identifies the specific object being accessed.
