IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications
IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.
IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.
- Runtime mediation of IDOR/BOLA via SQL-sink interception and rewriting at MyBatis/JDBC boundary
- Propagates identity context across requests, async tasks, and data access via trace identifier
- Supports ownership predicates, join-derived ownership, group probes, and sensitive-column mediation
- Worst-case guard latency 0.17 ms; optimization cuts average overhead by over 90% to 0.017 ms
From the original article
1 min read at arxiv.orgInsecure Direct Object Reference (IDOR), often modeled as Broken Object-Level Authorization (BOLA), remains prevalent in Java database applications because identity and authorization checks at the controller or service layer are disconnected from SQL execution based on resource identifiers.
By Yuewantong Song · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.