400$ WORTH IDOR AND IDOR EXPLAINED

Hello Everyone out there! This days i’m busy with some other stuff but after a long interval of time in April i again started to hunt bugs to get some bulks for my vacation trip lol :p . When i started hunting in April, I set my aim to InvisionApp.com.

What is IDOR ?
In simple words we can say, taking actions from another user’s account from your account without any interaction with user.

Why IDOR happen?
This happen when a backend have lack of authentication check, check my bellow explanation if you want to understand it
Suppose a web app is deleting user account in this way,

Delete Account form
1
2
3
4
<form method="post" action="http://vulnerable.com/user/delete_account/">
<input type="hidden" name="user_id" value="12345678">
<input type="submit" value="Delete Account">
</form>

Code working on /user/delete_account/
1
2
3
4
5
6
7
8
9
10
11
<?php
include "connection_db.php";
$user_id = $_POST['user_id'];
$sql = "DELETE FROM user WHERE id={$user_id}";
if ($conn->query($sql) === TRUE) {
    echo "User account deleted successfully";
} else {
    echo "Error deleting user account " . $conn->error;
}
?>

Okay as you seen there is no authentication check whenever a valid user_id value will be given and if it exist in DB it will be deleted which is so critical, this can be prevented in many ways like session check a password verification and many  other ways. i hope now you understood how IDOR works now please read bellow PoC.

While testing InvisionApp i came across Board section where you can make board and post in it and anyone can comment on it only ADMIN of board have rights to delete any other comment. So i created two accounts one was admin and one was normal user, and tried to delete Admin’s comment. So let me be in short bellow is the reproduction steps,


Steps to Reproduce : “A” Admin & “B” Attacker

1- Sign in from 2 different accounts ( A & B ) in 2 different browsers ( or use incognito as 2nd browser )
2- Now go to “A” account and create a board and add anything in it.
3- Comment from both “A” & “B” account.
4- Note down comment id of vitim’s comment ( Means ID of “A” )
5- Now go to “B” account, and capture the request while deleting comment of “B” account and change comment id (of “A” account) in URL ( Example : api/board/item/comment/*COMMENT ID* )
In “B” account u do not have option to delete comment of admin which is “A”
6- Status will be “200 OK” and comment should be deleted of another account


HTTP Request Example

DELETE /api/board/item/comment/*VICTIM COMMENT ID* HTTP/1.1
Host: projects.invisionapp.com
Connection: keep-alive
X-Timezone-Offset: -420
Origin: https://projects.invisionapp.com
X-XSRF-TOKEN: dTK57p6DW5mteX-nBBanCmeza0RUvUaI1JksYSQF0cU
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36
X-Referrer-Hash: #/boards/2636413/80399396
Accept: application/json, text/plain, /
X-Page-Loaded-At: 1459747535276
Referer: https://projects.invisionapp.com/d/main
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: ** Cookies Goes Here **

Bug Timeline :
3rd April : Reported Bug.
6th April : Triaged.
10th April : Given to developers to fix.
14th April : Asked to confirm the fix.
14th April : Fix confirmed by me
15th April : Rewarded with 400 USD

Video Poc :



6 comments:

  1. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (hydracards63@gmail.com) for how to get it and it cost,and how to also hack credit cards and send the money to your self,we are located around the world, these cards works on any ATM machine and it works according to it's activation.

    ………. EXPLANATION OF HOW THESE CARD WORKS……….

    You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT #1,000, 2nd VAULT #5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done.

    ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. To get the card email (hydracards63@gmail.com)

    ReplyDelete
  2. عن طريق شركة تسليك مجارى بالدمام سوف تتخلصون من المشاكل التي تتعرض لها مواسير الصرف الصحي بإستمرار حيث تعتبر شركة أبراج دبي واحدة من أهم و أفضل الشركات التي تقدم لكم خدمات مميزة .

    للتواصل الآن عن طريق :-

    http://abraj-dubai.net/%D8%B4%D8%B1%D9%83%D8%A9-%D8%AA%D8%B3%D9%84%D9%8A%D9%83-%D9%85%D8%AC%D8%A7%D8%B1%D9%89-%D8%A8%D8%A7%D9%84%D8%AF%D9%85%D8%A7%D9%85-%D9%88%D8%A7%D9%84%D9%82%D8%B7%D9%8A%D9%81/

    ReplyDelete

Powered by Blogger.