RGhost · Report #861849
Idor on the DELETE /comments/
Validstatus
mediumseverity
37upvotes
13 May 2020disclosed
Summary
Here in the scenario, the attacker was able to abuse comment id of another user by manipulating the request, including delete function and edit. The interesting part was that the application was throwing the comment content after executing the request on the page itself. As the comment ID's were in numbers the attacker used it with an intruder by their number range, further enumerating all the comments in every thread in the web application.
How it was found
Summary:
[Idor on /comments]
Steps To Reproduce:
[Make sure you have 2 different ID's to maintain 2 different session for ensurity]
- The request can be tamper with the ID of different (comment) both the functions of edit/delete can be used
- Delete gets hampered with the Captcha which is thrown but the Comment of different user can be observed in the request
- Assume user 1"victim" made a comment "comment X" user 2 can edit the request for editing his comment "Y" to "X" further as the attacker failed editing the comment of victim, further disabling the edit option for user 1 :| that will make user 1"victim" left with only option to delete the comment. sed very sed
- Even this works widely with Burp_Intruder that means it doesn't even have rate limit.
Impact
An attacker with a privilege to the user can harness the activities of any user around intentionally or target them widely.