400$ WORTH IDOR AND IDOR EXPLAINED

Hello Everyone out there! This days i’m busy with some other stuff but after a long interval of time in April i again started to hunt bugs to get some bulks for my vacation trip lol :p . When i started hunting in April, I set my aim to InvisionApp.com.

What is IDOR ?
In simple words we can say, taking actions from another user’s account from your account without any interaction with user.

Why IDOR happen?
This happen when a backend have lack of authentication check, check my bellow explanation if you want to understand it
Suppose a web app is deleting user account in this way,

Delete Account form
1
2
3
4
<form method="post" action="http://vulnerable.com/user/delete_account/">
<input type="hidden" name="user_id" value="12345678">
<input type="submit" value="Delete Account">
</form>

Code working on /user/delete_account/
1
2
3
4
5
6
7
8
9
10
11
<?php
include "connection_db.php";
$user_id = $_POST['user_id'];
$sql = "DELETE FROM user WHERE id={$user_id}";
if ($conn->query($sql) === TRUE) {
    echo "User account deleted successfully";
} else {
    echo "Error deleting user account " . $conn->error;
}
?>

Okay as you seen there is no authentication check whenever a valid user_id value will be given and if it exist in DB it will be deleted which is so critical, this can be prevented in many ways like session check a password verification and many  other ways. i hope now you understood how IDOR works now please read bellow PoC.

While testing InvisionApp i came across Board section where you can make board and post in it and anyone can comment on it only ADMIN of board have rights to delete any other comment. So i created two accounts one was admin and one was normal user, and tried to delete Admin’s comment. So let me be in short bellow is the reproduction steps,


Steps to Reproduce : “A” Admin & “B” Attacker

1- Sign in from 2 different accounts ( A & B ) in 2 different browsers ( or use incognito as 2nd browser )
2- Now go to “A” account and create a board and add anything in it.
3- Comment from both “A” & “B” account.
4- Note down comment id of vitim’s comment ( Means ID of “A” )
5- Now go to “B” account, and capture the request while deleting comment of “B” account and change comment id (of “A” account) in URL ( Example : api/board/item/comment/*COMMENT ID* )
In “B” account u do not have option to delete comment of admin which is “A”
6- Status will be “200 OK” and comment should be deleted of another account


HTTP Request Example

DELETE /api/board/item/comment/*VICTIM COMMENT ID* HTTP/1.1
Host: projects.invisionapp.com
Connection: keep-alive
X-Timezone-Offset: -420
Origin: https://projects.invisionapp.com
X-XSRF-TOKEN: dTK57p6DW5mteX-nBBanCmeza0RUvUaI1JksYSQF0cU
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36
X-Referrer-Hash: #/boards/2636413/80399396
Accept: application/json, text/plain, /
X-Page-Loaded-At: 1459747535276
Referer: https://projects.invisionapp.com/d/main
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: ** Cookies Goes Here **

Bug Timeline :
3rd April : Reported Bug.
6th April : Triaged.
10th April : Given to developers to fix.
14th April : Asked to confirm the fix.
14th April : Fix confirmed by me
15th April : Rewarded with 400 USD

Video Poc :



7 comments:

  1. I am not sure it is IDOR or CSRF

    ReplyDelete
  2. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (hydracards63@gmail.com) for how to get it and it cost,and how to also hack credit cards and send the money to your self,we are located around the world, these cards works on any ATM machine and it works according to it's activation.

    ………. EXPLANATION OF HOW THESE CARD WORKS……….

    You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT #1,000, 2nd VAULT #5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done.

    ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. To get the card email (hydracards63@gmail.com)

    ReplyDelete
  3. عن طريق شركة تسليك مجارى بالدمام سوف تتخلصون من المشاكل التي تتعرض لها مواسير الصرف الصحي بإستمرار حيث تعتبر شركة أبراج دبي واحدة من أهم و أفضل الشركات التي تقدم لكم خدمات مميزة .

    للتواصل الآن عن طريق :-

    http://abraj-dubai.net/%D8%B4%D8%B1%D9%83%D8%A9-%D8%AA%D8%B3%D9%84%D9%8A%D9%83-%D9%85%D8%AC%D8%A7%D8%B1%D9%89-%D8%A8%D8%A7%D9%84%D8%AF%D9%85%D8%A7%D9%85-%D9%88%D8%A7%D9%84%D9%82%D8%B7%D9%8A%D9%81/

    ReplyDelete
  4. I have been happy all my life because I found a saviour that always got my back when it comes to hacking of devices at a very affordable price a big shout out to spyexpert0@gmail.com Thank you so much.

    ReplyDelete
  5. Bulk Fullz Available

    CC Fullz with SSN info
    SSN DOB DL Fullz with Employee Info
    High Credit Scores Fullz (700+)
    Dumps With Pin Codes
    Business EIN Fullz
    Office365 Leads

    Fresh Spammed & Verified
    Bulk order will be preferable
    24/7 Delivery

    @killhacks .. ICQ/Telegram
    peeterhacks .. Wickr/Skype

    Sp-amming Complete Package Available (All Tools with Tuts)
    Hack-ing Stuff with All Tools, Tutorials, Ebooks, Guides
    Carding Cash out Methods/Tutorials
    Fr**d B***e 2021/2022
    D**k/D88p W-eb Complete Course with Video Tuts
    FB/WA Hac-king
    SMTP's/RDP's/C-panels
    Shells/Brutes
    Key-Loggers/Kali Linux Master Class
    BTC Cracker/Flasher
    SQLi Injector
    Working Mega Links/Onion Links
    Combos/Logins
    PayPal Logins/Coinbase Logins
    Office365 Logs
    Senders/Mailers/Web-mailers

    I.C.Q } 752822040
    Tel.gram } @leadsupplier
    Skype/Wickr } peeterhacks

    Tools will be given on demand
    Full Packages are also available
    All stuff will be guaranteed/Verified
    Just Buy & Start Work

    ReplyDelete

Powered by Blogger.