Login to any account with the emailaddress

Summary

Introduction

An attacker just needs to supply an email address to gain a valid access token for the Zomato applications. Thus any account on Zomato can be fully accessed with just the email address.

#Endpoint /v2/auth.json

Impact

Critical, without any user interaction an attacker can access any account.

At some point I started focusing on the mobile app, since in my experience a mobile app has more server-side (read criticial) issues, while a webapplication has more client-side vulnerabilities. After testing the login flow for the three different options: Facebook, Google and password based, I noticed that Google login looked slightly weird in the fact that a lot of data was send besides the Google OAuth token. Thus I started stripping parameters one by one after which I noticed that only the email of a user was required to login. This request would look like:

POST /v2/auth.json?isGoogle=true HTTP/1.1
X-API-Key: 4749b89651969b87a3kfc739o254ada2
Content-Type: application/x-www-form-urlencoded
Content-Length: 21
Host: api.zomato.com
Connection: close

[email protected]

Thus I could login as any user on Zomato given I knew their email address.