U.S. Dept Of Defense · Report #969223
IDOR to Account Takeover on https://████/index.html
Summary
More details about the report could be found at my blogpost: https://naglinagli.github.io/DoD_IDOR/
I would like to thank the DoD for a quick triage and resolution regarding the issue.
How it was found
Hello Team!
Summary:
I found when you wish to update your profile on https://███████/ after your login through https://██████████/signIn/signIn.html website due to an IDOR.
This IDOR gives you the opportunity to change the origin email for the registered account by changing the ID parameter on the following request, i assume that if i would do it on the id=1 i would takeover the admin account, this is due to not requiring the OLD password to make an email change, aswell as no restriction to make POST actions on different account IDS.
Description:
IDOR chained to full Account Takeover on ██████ domain.
Account
Step-by-step Reproduction Instructions
- Register an account at https://█████████/signIn/CreateAccount.html (Attacker)
- Login to your account and go the https://███████/signIn/account page
- Click on the "update" button located at thetop middle, and capture the request on BURP
- Now change the ID parameter on the request to the victims, change the email, and you successfully have managed to switch his email.
Request:
███
Video PoC:
█████
Suggested Mitigation/Remediation Actions
- Implementing email request change based on OLD password input
- Returning 403/401 when user account attempts to change another user ID settings.
Disclaimer
as you might notice the domain is https://██████/signIn/signIn.html when you sign in (.mil site), and it redirects you afterwards to https://██████████/ with the Compromised account, therefore i considered this In Scope.
Best Regards, Nagli
Impact
Issuing the malicious request on the victim account ID will lead to account takeover by replacing the email of the victim with the email of the attacker, and requesting a new password using the Forgot password option.