Non-premium user can disable Ads in japanese version of dic.pixiv.net

Summary

Summary

A vulnerability is identified in the Japanese version of the pixiv dictionary website (dic.pixiv.net) where non-premium users can disable advertisements. Normally, the ability to disable ads is restricted to premium users only, as indicated by the "P" icon next to the ad display settings in the user profile. However, due to improper access control at the API endpoint /_api/update_user_setting, any authenticated user can modify their ad display preferences without verification of premium status.

Steps to Reproduce

1. Disable any ad-blocker plugins in your browser and login as a non-premium Pixiv user
2. Browse to https://dic.pixiv.net (the Japanese version that doesn't have /en in the URL) and observe ads being displayed normally
3. Intercept any request to dic.pixiv.net that includes your cookies
4. Modify the request by:
   • Changing the HTTP method to POST
   • Setting the target URL to /_api/update_user_setting
   • Including the following JSON data in the request body: {"setting":{"showAds":false,"showNewUI":true}}
   • Note: No need to worry about the Content-Type header, as the server does not validate it
5. Send the request - the response should be {"success":true} {F4536685}
6. Go to your profile at https://dic.pixiv.net/mypage and verify that "表示しない" (Do not display ads) is now selected despite not being a premium user {F4536687}
7. Browse the site to confirm that ads are no longer displayed

Impact

The vulnerability allows non-premium users to access a feature that should be restricted to paying customers only. This can result in:

1. Lost revenue from reduced ad impressions when non-premium users disable advertisements
2. Devaluation of the premium subscription offering, as one of its key benefits (ad-free browsing) can be obtained for free
3. Potential widespread exploitation if knowledge of this vulnerability spreads among users