1280807 - Indirect object reference: mozilla.org

Status: RESOLVED INVALID

(Websites :: Other, defect)

Description

[Paresh]

Attachment: Attacker, who is an authorized system user, simply changes a parameter value that directly refers to a system object to another object the user isn’t authorized for.

Hey Team!

i found issue,by this i can change anyone's email subscription preference with user interaction.


if you register newsletter or anyting via email.
you are receiving emails from here @e.mozilla.org

in that mail you've option to unsubsribe .

steps to repro:
1. click on email unsubscription link.  it will redirect you to https://www.mozilla.org/en-US/newsletter/existing/4a215e7a-24c3-4d25-a856-3ed8e8b95d95/
2. click on save change, and capture request on burp suite
3.  request file attached. (post request - mozilla.txt)
4. now chanege user id ffeb0e17-3877-4087-8d22-c6aca7ab3975 to victim's user id and play request. 
done

Comment 1

[Paresh]

additional info :
 just by changing user id, attacker can change anyone's email preferences. 

fix:
Check access. Each use of a direct object reference from an untrusted source must include an access control check to ensure the user is authorized for the requested object.

Comment 2

[April King [:April]]

That userid is a UUID, and the address space for it is huge.  Have you determined a way to discover another user's user id?

Comment 3

[Paresh]

No i didnt find any way ! i guess it is possible by mozilla developer uuid generator, but not sure.

Comment 4

[April King [:April]]

Okay, then I'm afraid this is just functionality as intended.  Many email subscription systems work the exact same way, which is why you frequently don't need to login to unsubscribe from a list.  As long as your UUID remains unknown, then this doesn't really constitute a security risk.

Thank you for taking the time to report, however!