IDOR/BOLA in AffiliateRequestsController#approve allows unauthenticated approval

An unauthenticated user can approve any pending affiliate request by sending a GET request to /affiliate_requests/:id/approve with a valid external_id. The set_affiliate_request before_action fetches the AffiliateRequest object based on the user-supplied ID without checking if the user is authorized to approve it. The approve action is excluded from the authenticate_user! before_action and the can_perform_action? check only verifies the state of the request, not the user's permissions.

File: app/controllers/affiliate_requests_controller.rb
Route: GET /affiliate_requests/:id/approve
Vulnerable Code:

• before_action :set_affiliate_request, only: %i[approve ignore] (line 12)
• set_affiliate_request method (lines 111-113) uses AffiliateRequest.find_by_external_id!(params[:id])
• approve action (lines 63-74) calls perform_action_if_permitted which checks state but not user authorization.
• approve is in PUBLIC_ACTIONS (line 6), bypassing authentication.

Impact: Allows unauthenticated attackers to approve any pending affiliate request if they know or can guess the external_id.

Reproduction Steps:

1. Obtain the external_id of a pending affiliate request.
2. Send a GET request to /affiliate_requests/:id/approve with the obtained ID.
3. The request is approved without authentication or authorization check.

Recommendation: Implement proper authorization in the approve action to ensure only the legitimate seller associated with the affiliate request can approve it. This should likely involve checking current_user and scoping the AffiliateRequest lookup under the seller, e.g., current_user.affiliate_requests.find_by_external_id!(params[:id]) or using a proper authorization library like Pundit or Cancancan.

[msrkp]

https://gumroad.dev/affiliate_requests/FYUj2xiXNPPT0J2o02Wr-g==/approve

sounds like idor

[msrkp]

https://gumroad.com/affiliate_requests/mLKaMl99F5IN3Uv9EFvS9g==/approve

low impact cuz id looks not available/random