Discovering a High-Severity Bug in a Major Mobile Distribution Company

In the realm of cybersecurity, every now and then, one stumbles upon vulnerabilities that can have significant implications. Recently, I encountered such a scenario while conducting a security assessment for a large mobile distribution company. The journey, which involved subdomain enumeration, source code review, and leveraging Burp Suite for request interception, culminated in identifying a critical security flaw that allowed for a full account takeover.

The first step in my assessment involved subdomain enumeration. This technique helps in uncovering subdomains associated with a target domain, providing a broader attack surface. By using tools like Sublist3r and asset-finder, I compiled a comprehensive list of subdomains. Among these, one particular subdomain caught my attention due to its potential connection to administrative functions.

With the subdomains mapped out, I proceeded to review the source code of the web applications running on these subdomains. This step is crucial as it can reveal insecure coding practices and hidden endpoints. During my review, I discovered a poorly secured comment of a credential to another subdomain.

https://stage-seller-cf/REDACTED.com/login

i went to the subdomain and entered the credentials,but it was not correct.So i started to brute force and find a valid credential using Burp Suite. Here, i found the emp_id: 0 had similar password and i got access

But, it didn’t have admin access.

To further investigate the vulnerability, I turned to Burp Suite, a powerful tool for web application security testing. I began by intercepting a change password request made through the identified endpoint. Here’s where things got interesting.

Using Burp Suite, I captured the request and carefully analyzed its structure. The request parameters included the user ID and the new password. Notably, the endpoint did not require the current password for verification, relying solely on the user ID for authorization.

To test the severity of this vulnerability, I attempted to change the password of a high-privileged admin account using a lower-privileged user account. By modifying the intercepted request to include the admin account’s user ID and a new password, I sent the request and awaited the response.

To my surprise, the response indicated a successful password change. I immediately attempted to log in with the admin account using the newly set password. It worked. I had successfully taken over the admin account without having any prior admin access.

https://dev-oms.REDACTED.com

Discovering such a critical flaw necessitates responsible disclosure. I promptly contacted the company’s security team and provided detailed information about the vulnerability, including steps to reproduce and potential mitigations. Their response was swift, and the issue was patched within Days, preventing any potential exploitation.

If the vulnerability had not been promptly fixed, it could have led to severe consequences for the mobile distribution company as it had more than 40+ million users globally.

Admin Privileges: Malicious actors could exploit the vulnerability to gain unauthorized access to admin accounts. With admin privileges, they could control the entire system, including user data, financial transactions, and other critical functionalities.

Sensitive Data Exposure: Attackers could access sensitive information stored in the system, including personal data of users, payment details, and internal communications. This could lead to data breaches and privacy violations.

Fraudulent Transactions: Attackers could manipulate transactions, diverting funds or making unauthorized purchases. This could result in significant financial losses for both the company and its customers.
Ransomware and Extortion: Attackers might lock critical data or systems and demand a ransom for their release, further exacerbating financial strain.

This experience underscores the importance of thorough security assessments and the potential impact of even seemingly minor oversights in web application security. Through subdomain enumeration, source code review, and the use of tools like Burp Suite, one can uncover vulnerabilities that might otherwise go unnoticed.

As cybersecurity professionals, it is our responsibility to identify and report such flaws to ensure the safety and integrity of systems. This incident serves as a reminder of the critical role we play in safeguarding digital assets and protecting user data.