Testing AI Coding Agents Finds IDOR Vulnerabilities in All Six Generated Apps

Article Details

Attack Vectors

• All six generated applications had an IDOR flaw that could let an authenticated user access, download, or comment on documents without verifying ownership.
• One implementation used the hardcoded JWT secret 'dev-secret-change-me' when JWT_SECRET was unset, potentially allowing authentication forgery and administrative impersonation.
• One implementation returned live password-reset tokens in JSON responses when NODE_ENV was not set to 'production'.
• One implementation accepted uploads based only on client-supplied MIME types, allowing MIME-type spoofing.
• Multiple implementations interpolated attacker-controlled filenames into Content-Disposition headers without adequate escaping, enabling header injection.
• Some implementations did not revoke or revalidate tokens after password changes, role changes, account deactivation, or logout.
• One implementation allowed email changes without password re-verification.
• One implementation had a race condition in initial administrative provisioning that could allow concurrent registrations to escalate privileges.
• One implementation bypassed bcrypt for nonexistent accounts, creating a login timing side channel.
• Some implementations lacked rate limiting on authentication or password-reset endpoints, or failed to invalidate earlier reset tokens when issuing new ones.
• One implementation inconsistently applied CSRF protection, leaving state-altering document and user routes exposed.

Defensive Notes

• Centralize document ownership checks in reusable middleware and apply them to every read, download, and comment route.
• Fail startup if JWT_SECRET is missing or set to a known placeholder; do not silently use insecure defaults.
• Keep password-reset tokens out of response bodies and invalidate prior tokens when issuing new ones.
• Validate uploaded file content with magic-byte sniffing rather than trusting client-supplied MIME types.
• Escape or safely encode filenames before placing them in Content-Disposition headers.
• Revalidate account status and relevant user state against the database, and support token revocation after password or role changes, deactivation, and logout.
• Require password re-verification for sensitive account changes such as email updates.
• Make administrative provisioning atomic or otherwise safe against concurrent registrations.
• Use comparable password-hashing work for nonexistent and existing accounts to reduce timing differences.
• Apply rate limiting consistently to authentication and password-reset endpoints, and enforce CSRF protection on all state-altering routes.