5 ms·
This isn't a confused deputy problem. There's simply no authentication on the endpoint. As the article says, it's Insecure Direct Object Reference.
by tedunangst 6y ago
This isn't a confused deputy problem. There's simply no authentication on the endpoint. As the article says, it's Insecure Direct Object Reference.
- ryukafalz 6y agoThere's a sense in which it is also a confused deputy problem though. You don't have authority to the object (the video) yourself, but the Ads service does, and you can convince the Ads service to use its authority to reveal information on the video that you don't otherwise have access to.
- tedunangst 6y agoI guess. If the ad service let you create an ad consisting of another video, and you could embed a private video, that'd be pretty clear. This reminds me more of the Facebook bug where www.facebook.com had access control but mobile.facebook.com didn't. I don't really consider every endpoint to be a "deputy".
- mabbo 6y agoI think it depends how you look at it. > A confused deputy is a legitimate, more privileged computer program that is tricked by another program into misusing its authority on the system.[0] In this case, we know we don't have access to open the safe, but we were able to convince the deputy, who does have access to the safe, to give us what's inside one small piece at a time. The deputy didn't intend to empty the safe- he was only showing little bits of what's inside! That's all he's allowed to do with his access! I see where the OP is coming from in calling it that. [0]https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem