Restoring Permanently Deleted Projects via IDOR

I'm Abdulrahman Reda, a final-year Computer Science student in the IT department with a focus on penetration testing.

In this write-up, I'll share how I discovered an IDOR (Insecure Direct Object Reference) vulnerability that allowed me to restore a permanently deleted project in an organization. Although the report was eventually marked as a duplicate, I learned several valuable lessons during the research process.

Happy reading!

How I Noticed It

While testing for privilege escalation from the Owner role, I had Autorize running in the background to compare requests automatically.

I attempted to duplicate a project using the name "TEST", but the application returned the following error:

"This name is already used."

Since I was busy testing another feature, I left it for later.

A few minutes later I remembered that I had already deleted the project named TEST, so it shouldn't have existed anymore. That made the error message suspicious.

I saved the request and URL in my notes and continued testing other functionality before coming back to investigate it.

Studying the Functionality

My first assumption was that the validation might be client-side.

I intercepted the duplicate request with Burp Suite and modified the project name, but the server still returned the same "already used" error.

Next, I navigated to the Projects page and created a brand-new project named TEST.

Surprisingly, the project was created successfully.

At this point, I had two different behaviors:

• Duplicate Project: "TEST" already exists.
• Create New Project: "TEST" is accepted.

That inconsistency suggested that the duplicate functionality was treating deleted projects differently from the project creation flow.

Digging Deeper

To understand what was happening, I performed the following test:

1. Using the Manager account, I opened the TEST project.
2. Using the Owner account, I deleted that project.
3. I returned to the Manager session and refreshed the page.

Even though the project had been deleted, the Manager page was still accessible.

I even noticed that I could still perform actions such as inviting members to the deleted project.

That immediately caught my attention.

The Attack

I copied the URL from the Manager session after the project had been deleted.

When I opened the same URL again from owner session, the deleted project was still accessible.

I also noticed that project IDs were sequential, making enumeration possible.

I then:

1. Opened any existing project.
2. Changed the URL from:

https://example.com/projects/{existing-project-id}

https://example.com/projects/{existing-project-id}

to

https://example.com/projects/{deleted-project-id}

https://example.com/projects/{deleted-project-id}

The application loaded the deleted project successfully.

Finally, I clicked Restore Project, and the deleted project was restored successfully.

One interesting observation was that the Restore functionality appeared to have been designed only for archived projects, but it was also available for permanently deleted projects by directly referencing their IDs.

Thanks for reading!

Feel free to connect with me on LinkedIn: click here