IDOR in messages module - read, write and delete any player private messages

[Pajt9whauht283as]

Security report (responsible disclosure)

Vulnerabilities in the messages module — broken access control (IDOR)

All three handlers below trust client-supplied identifiers without verifying that the requesting player is part of the target conversation. Conversation IDs are sequential integers, so any player can enumerate and access any conversation on the server.

1. Read — any player can read any conversation's messages

apps/game/server/messages/messages.service.ts:128-142

async handleFetchMessages(reqObj: PromiseRequest<MessagesRequest>, resp: PromiseEventResp<Message[]>) {
  try {
    const messages = await MessagesDB.getMessages(reqObj.data);
    ...

apps/game/server/messages/messages.database.ts:43-64

async getMessages(dto: MessagesRequest): Promise<Message[]> {
  ...
  WHERE conversation_id = ?

conversationId and page come straight from the client (reqObj.data), and the query has no participant = ? check. Compare with getConversations (messages.database.ts:9-25) which filters by participant. Sending any existing conversationId returns the full message history.

2. Write — any player can post messages into any conversation

apps/game/server/messages/messages.service.ts:144-152

async handleSendMessage(reqObj: PromiseRequest<PreDBMessage>, ...) {
  ...
  const conversationDetails = await this.messagesDB.getConversation(messageData.conversationId);
  const message = await this.messagesDB.createMessage({ ... conversationId: messageData.conversationId, ... });

The fetched conversation is only used for the label/layout in the broadcast; membership is never verified before createMessage inserts the message.

3. Delete — any player can delete any message

apps/game/server/messages/messages.service.ts:259-267

async handleDeleteMessage(reqObj: PromiseRequest<Message>, ...) {
  ...
  await this.messagesDB.deleteMessage(reqObj.data);

apps/game/server/messages/messages.database.ts:151-157

async deleteMessage(message: Message) {
  ...
  DELETE FROM npwd_messages WHERE id = ?

The whole Message object (including id) is client-controlled and there is no check that the message belongs to the caller.

Impact

• Full read of any player's private conversations (enumerate conversation_id 1..N)
• Message injection into any conversation (impersonation, phishing)
• Destructive deletion of any message in any conversation

Suggested fix

Verify membership before each operation, e.g. doesConversationExistForPlayer(conversationList, playerPhoneNumber) (already implemented at messages.database.ts:182-198) and pass the caller's phone number down to getMessages/deleteMessage (filter AND participant = ? / AND author = ?).

Happy to provide a repro privately if useful.