hydra-gate-no-admin-idor

To detect IDOR vulnerabilities in Nextcloud PHP controllers, scan methods annotated with NoAdminRequired to verify the presence of mandatory authorization guards like OCSForbiddenException or ownership checks, preventing unauthorized access to arbitrary object IDs.

An Insecure Direct Object Reference (IDOR) vulnerability in PHP applications occurs when controller methods expose sensitive data or actions without proper authorization guards, allowing authenticated users to access arbitrary object IDs without ownership verification.

Enforce OWASP A01:2021 authorization compliance in a CI/CD pipeline by automatically scanning PHP controller methods for missing authorization guards and flagging endpoints that allow unverified access to object IDs before deployment.

Yes, this automated security gate works with Nextcloud apps by specifically analyzing PHP controller methods annotated with NoAdminRequired to ensure they contain mandatory authorization guards and ownership checks.

An IDOR security warning triggers when PHP endpoint method bodies lack mandatory authorization guards like OCSForbiddenException throws or explicit ownership verification checks for the requested object IDs.