IDOR allowing to read another user's token on the Social Media Ads service

Summary

The hotfix was released asap. The investigation showed that there were no cases of vulnerability exploitation.

Social Media Ads is a tool for dedicated paid social specialists working with ads. The tool needs to interact with the user's social network account. To do this, Semrush collects a token to access and modify the advertising data of the social media account. There was a possible ability to brute force ids due to weak id generation by MongoDB. As a result, it was possible to access another user's token. MongoDB Object Ids have the following pattern:

• а 4-byte timestamp, representing the ObjectId's creation, measured in seconds since the Unix epoch.
• а 5-byte random value generated once per process. This random value is unique to the machine and process.
• а 3-byte incrementing counter, initialized to a random value.