[H1 Bug PoC 1] - Leaked Token and Reusability of Email Confirmation Link Leading to Account Takeover

[Chapter 1] - kerentanan pada sistem konfirmasi email dan konfirmasi perangkat di hackerone milik sorare. token konfirmasi yang seharusnya sekali pakai bocor melalui google indexing (google dork), lalu masih bisa dimanipulasi dan digunakan kembali meskipun statusnya sudah “invalid” atau “expired”.

selain itu, juga ditemukan bahwa dengan sedikit memodifikasi karakter tertentu pada token, attacker dapat login ke akun korban tanpa password hanya melalui tautan konfirmasi email atau perangkat tersebut. selain itu, attacker bisa masuk ke profil pengguna lain dan mengubah informasi seperti nama atau foto profil.

dampaknya adalah potensi account takeover, akses tanpa otorisasi ke akun pengguna, kebocoran informasi pribadi (pii), serta penyalahgunaan akun korban jika tautan konfirmasi bocor atau terindeks mesin pencari.

a vulnerability was found in the email confirmation and device confirmation system on hackerone for sorare. the confirmation token, which is supposed to be single-use, was exposed through google indexing (google dorking). it could still be manipulated and reused even after it was marked as “invalid” or “expired”.

in addition, it was discovered that by slightly modifying certain characters in the token, an attacker could log into a victim’s account without a password, simply by using the email or device confirmation link. in some cases, the attacker could also access other users’ profiles and change information such as the name or profile picture.

the impact of this issue includes potential account takeover, unauthorized access to user accounts, exposure of personal information (pii), and abuse of victim accounts if the confirmation link is leaked or indexed by search engines.

Reference & Source: https://hackerone.com/reports/1817214

#cybersecurity #bugbounty #ethicalhacking #webapp #infosec #hackerone #report #vulnerability #youtube #video #proofofconcept #show

Видео [H1 Bug PoC 1] - Leaked Token and Reusability of Email Confirmation Link Leading to Account Takeover канала Cyber Kenma