{"id":325,"date":"2023-12-29T14:37:23","date_gmt":"2023-12-29T09:07:23","guid":{"rendered":"https:\/\/ganofins.com\/blog\/?p=325"},"modified":"2024-01-15T13:48:38","modified_gmt":"2024-01-15T08:18:38","slug":"1000-bounty-for-accessing-any-users-account-improper-authentication-issue","status":"publish","type":"post","link":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/","title":{"rendered":"$1000 bounty for accessing any user’s account"},"content":{"rendered":"\n

Hello everyone,<\/p>\n\n\n\n

It’s been a while since I have written a blog post but since it’s end of year and this has been amazing year and I learned a lot from the cyber security community. I am grateful for the cyber security community out there, because of there awesome writeups\/articles about the bugs they found I have learned a lot from them. So, I will try contributing a bit to it.
<\/p>\n\n\n\n

This writeup is about a user improper authentication issue which I found in one of my favorite private program<\/p>\n\n\n\n

Technical Details<\/h4>\n\n\n\n

Let’s get right into it, so the main domain of the program target.com uses another subdomain api.target.com for the API requests. And this another subdomain api.target.com points to some other subdomain abc.api.target.com of the target.
Now based on what I understood they were checking if the user is authenticated or not on their api.target.com subdomain, if the user was authenticated then this subdomain api.target.com would have returned the authenticated user’s UUID and authenticated user’s email address then would have forwarded these data in the request headers to abc.api.target.com subdomain.<\/p>\n\n\n\n

Just to clarify the main API subdomain abc.api.target.com which retrieves the data from database or performs any functions on the user’s account is getting only request headers containing the user’s UUID, user;s email ID which tells that subdomain to access this account and perform any function on this account. Basically, the attacker only needed a victim’s UUID and victim’s email to access or perform any action in that victim’s account.<\/p>\n\n\n\n

How I found this issue<\/h4>\n\n\n\n

While hunting on the program, I wasn’t catching anything interesting. So I randomly started checking up on the open ports of API subdomain of target.com, and I found that this subdomain api.target.com was pointing to another subdomain abc.api.target.com
Then I thought of trying API calls directly on this abc.api.target.com instead of api.target.com with the session cookie. I was getting a missing header error, so I ran param miner on that endpoint and param miner found these X-User-Id<\/strong><\/em> and X-User-Email<\/em><\/strong> request headers. Then on trying up the user ID and user email in these headers, it returned the details of that user in the response.<\/p>\n\n\n\n

\"user

But the bad thing was the attacker would require a victim’s UUID in order to exploit this issue. And I couldn’t find any such API endpoint which was leaking the UUIDs of the victims else this would have been Critical<\/em><\/strong> severity issue. But still this was rated as High<\/strong><\/em> severity and was resolved resulted in $1000 bounty.<\/p>\n\n\n\n

Well this one of the interesting issue which I found in 2023.<\/p>\n\n\n\n

I hope it was a good read for you.
Thank you all for reading!
Happy New Year!<\/p>\n","protected":false},"excerpt":{"rendered":"

Hello everyone, It’s been a while since I have written a blog post but since it’s end of year and this has been amazing year and I learned a lot from the cyber security community. I am grateful for the…<\/p>\n","protected":false},"author":1,"featured_media":328,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[59],"tags":[76,74,63,13,62,73,12,75],"class_list":["post-325","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-writeups","tag-76","tag-authentication-issue","tag-bug-bounty","tag-ganofins","tag-ganofins-writeups","tag-improper-authentication","tag-tutorials-with-ganofins","tag-user-authentication-issue"],"yoast_head":"\n$1000 bounty for accessing any user's account - Ganofins Blog<\/title>\n<meta name=\"description\" content=\"This writeup is about a user improper authentication issue which I found in one of my favorite private program. The main domain of the target\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"$1000 bounty for accessing any user's account - Ganofins Blog\" \/>\n<meta property=\"og:description\" content=\"This writeup is about a user improper authentication issue which I found in one of my favorite private program. The main domain of the target\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/\" \/>\n<meta property=\"og:site_name\" content=\"Ganofins Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-12-29T09:07:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-15T08:18:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"739\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"ganofins\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ganofins\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/\"},\"author\":{\"name\":\"ganofins\",\"@id\":\"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db\"},\"headline\":\"$1000 bounty for accessing any user’s account\",\"datePublished\":\"2023-12-29T09:07:23+00:00\",\"dateModified\":\"2024-01-15T08:18:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/\"},\"wordCount\":480,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db\"},\"image\":{\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png\",\"keywords\":[\"$1000\",\"authentication issue\",\"bug bounty\",\"ganofins\",\"ganofins writeups\",\"improper authentication\",\"tutorials with ganofins\",\"user authentication issue\"],\"articleSection\":[\"Writeups\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/\",\"url\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/\",\"name\":\"$1000 bounty for accessing any user's account - Ganofins Blog\",\"isPartOf\":{\"@id\":\"https:\/\/ganofins.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png\",\"datePublished\":\"2023-12-29T09:07:23+00:00\",\"dateModified\":\"2024-01-15T08:18:38+00:00\",\"description\":\"This writeup is about a user improper authentication issue which I found in one of my favorite private program. The main domain of the target\",\"breadcrumb\":{\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage\",\"url\":\"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png\",\"contentUrl\":\"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png\",\"width\":1920,\"height\":739,\"caption\":\"user improper authentication\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ganofins.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"$1000 bounty for accessing any user’s account\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ganofins.com\/blog\/#website\",\"url\":\"https:\/\/ganofins.com\/blog\/\",\"name\":\"Ganofins Blog\",\"description\":\"Learn Today Apply Today\",\"publisher\":{\"@id\":\"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ganofins.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db\",\"name\":\"ganofins\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ganofins.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/ganofins.com\/blog\/wp-content\/litespeed\/avatar\/a1fd68d9e27b63b4007d850d5d958b59.jpg?ver=1776081109\",\"contentUrl\":\"https:\/\/ganofins.com\/blog\/wp-content\/litespeed\/avatar\/a1fd68d9e27b63b4007d850d5d958b59.jpg?ver=1776081109\",\"caption\":\"ganofins\"},\"logo\":{\"@id\":\"https:\/\/ganofins.com\/blog\/#\/schema\/person\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"$1000 bounty for accessing any user's account - Ganofins Blog","description":"This writeup is about a user improper authentication issue which I found in one of my favorite private program. The main domain of the target","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/","og_locale":"en_US","og_type":"article","og_title":"$1000 bounty for accessing any user's account - Ganofins Blog","og_description":"This writeup is about a user improper authentication issue which I found in one of my favorite private program. The main domain of the target","og_url":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/","og_site_name":"Ganofins Blog","article_published_time":"2023-12-29T09:07:23+00:00","article_modified_time":"2024-01-15T08:18:38+00:00","og_image":[{"width":1920,"height":739,"url":"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png","type":"image\/png"}],"author":"ganofins","twitter_card":"summary_large_image","twitter_misc":{"Written by":"ganofins","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#article","isPartOf":{"@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/"},"author":{"name":"ganofins","@id":"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db"},"headline":"$1000 bounty for accessing any user’s account","datePublished":"2023-12-29T09:07:23+00:00","dateModified":"2024-01-15T08:18:38+00:00","mainEntityOfPage":{"@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/"},"wordCount":480,"commentCount":0,"publisher":{"@id":"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db"},"image":{"@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage"},"thumbnailUrl":"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png","keywords":["$1000","authentication issue","bug bounty","ganofins","ganofins writeups","improper authentication","tutorials with ganofins","user authentication issue"],"articleSection":["Writeups"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/","url":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/","name":"$1000 bounty for accessing any user's account - Ganofins Blog","isPartOf":{"@id":"https:\/\/ganofins.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage"},"image":{"@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage"},"thumbnailUrl":"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png","datePublished":"2023-12-29T09:07:23+00:00","dateModified":"2024-01-15T08:18:38+00:00","description":"This writeup is about a user improper authentication issue which I found in one of my favorite private program. The main domain of the target","breadcrumb":{"@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#primaryimage","url":"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png","contentUrl":"https:\/\/ganofins.com\/blog\/wp-content\/uploads\/2023\/12\/s.png","width":1920,"height":739,"caption":"user improper authentication"},{"@type":"BreadcrumbList","@id":"https:\/\/ganofins.com\/blog\/1000-bounty-for-accessing-any-users-account-improper-authentication-issue\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ganofins.com\/blog\/"},{"@type":"ListItem","position":2,"name":"$1000 bounty for accessing any user’s account"}]},{"@type":"WebSite","@id":"https:\/\/ganofins.com\/blog\/#website","url":"https:\/\/ganofins.com\/blog\/","name":"Ganofins Blog","description":"Learn Today Apply Today","publisher":{"@id":"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ganofins.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/ganofins.com\/blog\/#\/schema\/person\/ce75d64682bcbf85acac97c9cb93a8db","name":"ganofins","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ganofins.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/ganofins.com\/blog\/wp-content\/litespeed\/avatar\/a1fd68d9e27b63b4007d850d5d958b59.jpg?ver=1776081109","contentUrl":"https:\/\/ganofins.com\/blog\/wp-content\/litespeed\/avatar\/a1fd68d9e27b63b4007d850d5d958b59.jpg?ver=1776081109","caption":"ganofins"},"logo":{"@id":"https:\/\/ganofins.com\/blog\/#\/schema\/person\/image\/"}}]}},"amp_enabled":true,"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/posts\/325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/comments?post=325"}],"version-history":[{"count":5,"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/posts\/325\/revisions"}],"predecessor-version":[{"id":334,"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/posts\/325\/revisions\/334"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/media\/328"}],"wp:attachment":[{"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/media?parent=325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/categories?post=325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ganofins.com\/blog\/wp-json\/wp\/v2\/tags?post=325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}