Spotify (Playlists) #2 - Authentication Bypass Vulnerability

Document Title:
===============
Spotify (Playlists) #2 - Authentication Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1663


Release Date:
=============
2016-01-18


Vulnerability Laboratory ID (VL-ID):
====================================
1663


Common Vulnerability Scoring System:
====================================
7.1


Product & Service Introduction:
===============================
With Spotify, it’s easy to find the right music for every moment – on your phone, your computer, your tablet and more.
There are millions of tracks on Spotify. So whether you’re working out, partying or relaxing, the right music is always 
at your fingertips. Choose what you want to listen to, or let Spotify surprise you. You can also browse through the music 
collections of friends, artists and celebrities, or create a radio station and just sit back. Soundtrack your life with 
Spotify. Subscribe or listen for free.

(Copy of the Vendor Homepage: https://www.spotify.com/us/about-us/contact/ )


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered an authentication bypass vulnerability in the official Spotify online service web-application.


Vulnerability Disclosure Timeline:
==================================
2016-01-16: Researcher Notification & Coordination (Karim Rahal)
2016-01-17: Vendor Notification (Spotify Security Team)
2016-00-17: Vendor Response/Feedback (Spotify Security Team)
2016-01-17: Vendor Fix/Patch (Spotify Developer Team)
2016-01-17: Security Acknowledgements (Spotify Security Team)
2016-01-18: Security Bulletin (Spotify Security Team) [Acknowledgements]
2016-01-18: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Spotify
Product: Playlist - Web Application 2016 Q1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
This Bug is an Authentication Bypass which allows an Attacker to visit Playlists(content) which he is not allows to visit.
The Authentication Bypass issue makes the attacker able to Visit Secret and Deleted Playlist URL(s) and is able to access 
them due to a lack of identification and lack of the Delete Process.

Vulnerable Function(s):
				[+] Playlist Secret
				[+] Deleted Playlists


Proof of Concept (PoC):
=======================
The vulnerability can be reproduced by remote attackers with low privileged web-application user account and low or medium user interaction.
For security demonstration or reproduce follow the provided information and steps below to continue.

Manually reproduce of the vulnerability ... #1
1. Open an Account
2. Copy The Link fo the Playlist
3. Save The Link somewhere
4. Make The Playlist Secret
5. Open a New Account
6. Visit the Playlist Link
7. You will see you are able to access it
Video: https://www.youtube.com/watch?v=QrI20x0T45I

Manually reproduce of the vulnerability ... #2
[Deleted Playlists Auth Bypass] Reproduce Steps
1. Open an Account
2. Copy The Link fo the Playlist
3. Save The Link somewhere
4. Delete The Playlist
5. Open a New Account
6. Visit the Playlist Link
7. You will see you are able to access it
Video: https://www.youtube.com/watch?v=Z2g-IBVJDtc


Security Risk:
==============
The security risk of the authentication bypass vulnerability in the spotify web-application is estimated as high. (CVSS 7.1)


Credits & Authors:
==================
Karim Rahal [[email protected] / [email protected]] - @KarimMTV


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    [email protected] 	- [email protected] 	       		- [email protected]
Section:    magazine.vulnerability-db.com	- vulnerability-lab.com/contact.php		       	- evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
([email protected] or [email protected]) to get a permission.

				Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™