Deriv.com · Report #98247
login to any user's cashier account and full account information disclosure
Summary
This bug allowed an attacker to login to any user's cachier account , view the user full account details and withdraw money from the user's account to the attacker's credit card , skrill ..etc. http://zombiehelp54.blogspot.com/2015/11/binarycom-critical-vulnerability-to.html
How it was found
Hi , I have found an issue allowing an attacker to login to any user's cashier account and view sensitive user information by just knowing the user account ID. #Steps to reproduce:
-
open 2 browsers and create 2 accounts , login with each account on a browser.
-
let's call account 1 , the victim and account 2 is the attacker.
-
from the victim account , make sure you are using real account and then go to https://www.binary.com/cashier then click Deposit then click Continue.
-
From the attacker account go to https://www.binary.com/cashier then click Deposit then click Continue.
-
Now you'll see your cashier account , inspect the page elements using your browser inspector then find the
<iframe>tag with the id attribute cashiercont. it will look like this :
<iframe src="https://cashier.binary.com/login.asp?Sportsbook=Binary (CR) SA USD&PIN=CR342435&Lang=en&Password=0e552ae717a1d08cb147f132a31676559e3273ef&Secret=1328d47abeda2b672b6424093c4dbc76&Action=DEPOSIT" frameborder="0" width="100%" height="2000" id="cashiercont" scrolling="auto" style="padding:0px;margin:0px;"></iframe>
- Edit the
<iframe>element and Change thePINparameter value to the victim account id value so it should be like this after the edit:
<iframe src="https://cashier.binary.com/login.asp?Sportsbook=Binary (CR) SA USD&PIN=<VICTIM_ACCOUNT_ID>&Lang=en&Password=0e552ae717a1d08cb147f132a31676559e3273ef&Secret=1328d47abeda2b672b6424093c4dbc76&Action=DEPOSIT" frameborder="0" width="100%" height="2000" id="cashiercont" scrolling="auto" style="padding:0px;margin:0px;"></iframe>
- Now you have successfully logged in the victim's cashier account , to view the victim account details , click the cashier button then next to the customer name click the view link and you'll see all the account details of the victim , including Full name , email and phone number which are the most sensitive here since they can be used in phishing.
Please tell me if you are having any issue reproducing this. Thanks