#permission-bug

[prakharprasad]

Flipkart.com - Elevation of Privilege Vulnerability

 Just wanted to share a privilege escalation vulnerability affecting Flipkart, a top-notch e-commerce website in India having local Alexa Internet ranking of 10.

Let's jump to the background of the issue. Flipkart allows users to save shipping addresses for future usage. As soon as the address is saved, a deletion option along with the saved address, something similar to the one below:

So once the delete option is hit, there would be a POST request sent to the server. The request is like:

                         There are two parameters going inside the body of POST request - __FK and address_id, __FK is the CSRF protection token used by Flipkart and address_id is a unique identifier for the saved address. So with each and every address saved in Flipkart for different users, address identifiers are saved along with them. So now comes the security issue, if one account tampers, then modifies the address_id of another user and replay the request, then server will delete saved address of another account. For example, say there are two users - A and B. A has saved a shipping address and has an address identifier ADD123 and user B somehow knows the identifier of A, so now B saves an address in his own account then, goes ahead to the delete option, then tampers the request and changes the address_id parameter to ADD123 then forwards the request to server, server would return a JSON object like below and delete the saved address of user A.

I'm a frequent user of Flipkart and I contacted their Security Team as soon as I confirmed the vulnerability at my end, this has been patched by them completely. Although looks severe but exploitability of this vulnerability was low as the address identifier was unpredictable for an individual user.  

[prakharprasad]

Dropbox for Business Mailing List Unsubscribe Users (Permission Issue)

I want to share my finding on a  recent security issue I discovered on Dropbox for Business mailing list. So, this bug allows me to unsubscribe any user account that is subscribed to Dropbox for Business mailing list. I discovered a page (https://lp.dropboxteam.com/UnsubscribePage.html) that allows you to unsubscribe your own account, from the mailing list by specifying YOUR OWN email address into the page. For normal flow, once the user submits his email address on that page a check should be performed based on his logged-in account, whether he's permissible to unsubscribe the email address submitted.If this check fails then action should be denied, right ?. The case in Dropbox was like if you submit any valid email address in the unsubscribe page, it will get unsubscribed without any permission check.See the below: VIDEO POC :

I reported this issue to Dropbox Security, they said :

The attacker would require knowledge of the users email address, and even then the non-deliver of the emails in question would not impact emails like password rest emails, shared folder emails etc. To be specific, its not a security threat to Dropbox users.

 So this issue remains unfixed (at least as of 22th May 2013)