Are TikTok’s new settings enough to keep kids safe?

TikTok, the now widely popular social media platform that allows users to create, share, and discover, amateur short clips—usually something akin to music videos—has been enjoying explosive growth since it appeared in 2017. Since then, it hasn’t stopped growing—more so during the current pandemic...

TikTok: Blocked user can send notification by liking the message due to Logical Bug

A functional bug had the potential to permit a blocked user to send notifications by liking another user's message.We thank @sandipgyawali for reporting this to our team and confirming the resolution...

TikTok Takes Teen Accounts Private

TikTok has decided to boost privacy measures for its underage users, the popular video-sharing social-media company announced. TikTok’s popularity is being driven by teens — the company reported in 2019 about 60 percent of its 26.5 monthly users are between the ages of 16 and 24, and these latest...

TikTok: Lack of rate limitation on careers site allows the attacker to brute force the verification code

An attacker could have potentially attempted to brute force the verification code needed to reset a candidate's password by leveraging a lack of rate limiting on the TikTok careers portal. We thank @iambouali for reporting this to our team and confirming the resolution...

The strangest cybersecurity events of 2020: a look back

This year is finally coming to an end, and it only took us about eight consecutive months of March to get here. There is a ton to talk about, and that’s without even discussing the literal global pandemic. You see, 2020s news stories were the pressure-cooker product of mania, chaos, and the...

TikTok: Blocked user can see live video

A flaw had the potential to cause a user's live videos to be suggested to a blocked user. We thank @sandipgyawali for reporting this to our team and confirming the resolution...

TikTok: HTML Injection through Account Name field on TikTok ads portal being rendered on emails

The Account Name field on the TikTok Ads Portal did not have restrictions on HTML tag injections which an attacker could have potentially used for phishing attacks. We thank @nagli for reporting this to our team and confirming the resolution...

TikTok: Multiple bugs leads to RCE on TikTok for Android

A series of WebView vulnerabilities were found including XSS which could have potentially led an attacker to achieve remote code execution. We thank @dphoeniixx for reporting this to our team and verifying the resolution!...

TikTok: External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing

A local file disclosure vulnerability was found which an attacker could have used to upload a payload file via the TikTok website and potentially exfiltrate arbitrary local system files. We thank @ach for reporting this to our team and confirming the resolution. Summary: FFmpeg is a free and...

Amazon Sues Instagram, TikTok Influencers Over Knockoff Scam

Instagram and TikTok social-media influencers Kelly Fitzpatrick and Sabrina Kelly-Krejci are among 13 defendants in a lawsuit filed by Amazon, which alleges that they participated in an an online scam to sell counterfeit luxury goods. Counterfeit goods are strictly forbidden in the Amazon...

TikTok: RCE on TikTok Ads Portal

The video upload endpoint on the TikTok Ads portal was potentially susceptible to remote code execution RCE due to a ffmpeg misconfiguration. We thank @ bubbounty for reporting this to our team and confirming the resolution. During my research on the TikTok Ads portal I found a RCE thought the...

TikTok: HTML Injection on Company Name on Email

By changing the company name to any HTML code on the TikTok Creator Marketplace, an attacker could potentially use this to send phishing emails to users containing injected HTML payload. We thank @gnux for reporting this to our team and confirming the resolution!...

TikTok: Information Disclosure of Advertiser Account on TikTok Ads Portal

In the TikTok Ads portal, if both invited Ad Accounts are part of the same business group, an exposed endpoint could potentially be exploited to view email address, phone number, company, and name of the Ad Account owner. We thank @emanuelharijanto for reporting this to our team and confirming th...

TikTok: [CSRF] TikTok Careers Portal Account Takeover

A missing CSRF protection and open redirect vulnerability was reported in the TikTok Careers portal single sign on flow which is used by applicants to apply for TikTok positions. This flaw was quickly remediated and does not impact TikTok.com or mobile application. We thank @lauritz for reporting...

TikTok Launches Bug Bounty Program Amid Security SNAFUs

TikTok has expanded its vulnerability disclosure policy to include a global bug-bounty program through a partnership with the ethical hacker platform HackerOne. The bug-bounty program launch signals a new direction for the Chinese-owned video-sharing app, which has been much maligned for its...

TikTok: Blind SSRF in ads.tiktok.com

A Server Side Request Forgery SSRF vulnerability was reported on the TikTok ads portal. This flaw has since been remediated. We thank @chihuahua for reporting this vulnerability to our team and confirming the resolution...

TikTok: CORS misconfiguration in TikTok ads portal

A CORS misconfiguration was discovered in the TikTok ads portal which could potentially allow an attacker to obtain user IDs and usernames of logged in users. This issue has been resolved. We thank @chihuahua for reporting this to our team...

TikTok: User In The Same Center Can Create CSRF To Change The Information About Business

A Cross Site Request Forgery CSRF vulnerability was reported on the TikTok ads portal. This flaw has since been remediated. We thank @sniper302 for reporting this vulnerability to our team...

TikTok: CORS bypass on TikTok Ads Endpoint

An endpoint used by the TikTok Ads portal was vulnerable to CORS bypass therefore potentially allowing an attacker to access information about tickets opened if the user were to click on a malicious link. We thank @sniper302 for reporting this to our team and confirming the resolution!...

TikTok: User Able to Reopen a Ticket by Modify the Request

Improper access control was reported on the TikTok ads portal. This issue has been resolved. We thank @gnux for reporting this vulnerability to our team and confirming the resolution...