Mozilla · Report #2387297
Bypass Email Verification on Add Email Monitoring
Summary
A security vulnerability has been identified in the email verification process of Mozilla Monitor. The issue allows an attacker to bypass the email verification step when adding a new email address for monitoring.
The vulnerability exploits a flaw in the verification mechanism where the verification token is exposed in the server response. By using this token, an attacker can manually verify any email address without having access to the associated inbox. This bypass enables unauthorized addition of email addresses to the monitoring service, leading to denial of service for users.
How it was found
Steps To Reproduce:
-
Login to https://monitor.firefox.com OR https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net and click Add email address █████████
-
Fill the victim's email address (I'm use my personal email) and click Send verification link ██████
-
Check the request on your burp suite intercept and turn on Response intercept to this request ████████
-
Wait until we got the response from the server and search the victim's email address, we can get the verification_token on the response ███████
-
For make sure the victim's email address is need a verification.. refresh your browser █████
-
Copy and Paste the verification_token from the response to this link:
https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net/api/v1/user/verify-email?token={verification_token} -
Open the link on your browser, Done.. the victim's email address is already verified ██████
Impact
Attacker can add the victim's email address without verification. And if attacker choose Send all breach alerts to primary email address, attacker will get a notification when victim's email address is leaked {F3074332}