# IDOR in backup recovery functionality

IDOR in Acronis backup recovery plan_operations/run endpoint let an authenticated attacker recover another org's backup to their own machine using a swapped X-Apigw-Session header.

- Payout: hidden
- Severity: high
- Program: Acronis
- Found by: 0xnullref
- Disclosed: 2024-11-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1901713
- Library page: https://bugbountylibrary.com/r/h1%3A1901713
- Tags: area:cloud domain:cloud impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high technique:recon vuln:access-control vuln:idor

**Target:** /bc/api/ams/recovery/plan_operations/run endpoint on beta-cloud.acronis.com
**Root cause:** The recovery plan_operations/run endpoint authorized the request based on the X-Apigw-Session header without verifying that the session's organization owned the referenced machine UUID and backup ID, allowing cross-tenant recovery.
**Steps:**
1. Log in to https://mc-beta-cloud.acronis.com with two devices present.
2. Open DEVICES, pick device_1 with a backup, choose recovery > select machine > device_2, and complete recovery steps.
3. Intercept the `/bc/api/ams/recovery/plan_operations/run` request in Burp.
4. Replay the request using the `X-Apigw-Session` header from a session belonging to a different organization.
5. Observe the recovery plan configured and run against the victim's backup.
**How found:** Researcher noticed the recovery flow's run request carried an X-Apigw-Session header and tested swapping it for a session from another organization, revealing the endpoint did not bind the operation to the owning tenant.
**Exploitation:** Attacker with a valid account and knowledge of the victim's machine UUID, backup ID and related parameters replays the recovery run request with their own X-Apigw-Session, causing the victim's backup to be recovered onto the attacker-controlled machine.
**Insight:** In multi-tenant backup/DR consoles, the recovery 'run' action is a separate authorization boundary from listing backups; replay the run request with a foreign session header and check whether machine UUID/backup ID ownership is re-validated server-side.