Published On: 17 May 2019
IDOR in twitter leads to Orders leakage Statistics
IDOR
Twitter | Web
---
LOW VALIDi found Insecure Direct Object Reference in "MoPub" twitter ads service .
Description
Twitter on its service "MoPub" statistics dedicated to the results of "Order", after the test shows that the endpoint "https://app.mopub.com/web-client/api/orders/stats/query" is infected with a "IDOR " bug Which led to the leak of private statistics "Orders" by another users
Impact
leakage statistics
Reproduction Steps
Step
1
[Create account in https://app.mopub.com/ and login
Step
2
[go to the link https://app.mopub.com/orders and create Order ]
Step
3
[using this POST Request you can disclose statistics another orders By changing the value of the parameter orderKeysin body request]
POST /web-client/api/orders/stats/query HTTP/1.1
Host: app.mopub.com
{"startTime":"2019-04-07","endTime":"2019-04-20","orderKeys":["43b29d60a9724fa9abbdc800044002d6"]}