A Node.js implementation of the Acme Air Sample Application. With datastore support of MongoDB, Cloudant, Cassandra. With runtime support of Bluemix/CloudFoundry, Docker... With Micro-Services.
Apache License 2.0
109
stars
74
forks
source link
Vuln: ability to access/modify arbitrary user's full information from another user's session #22
To preface this: yes, I'm aware that this is a sample application that's not designed to be secure or anything like that (y'know, what with the auto-filled default values and everything). I just wanted to make sure that people who planned on using this application as inspiration for a real-world application would be aware of this issue.
By taking advantage of the sessionid cookie given to users, any user is able to access any other user's information. This is because the application doesn't associate sessions with users.
An example of exploiting this:
Log into the application as uid0@email.com
Grab the sessionid cookie given by the server
Send a request to /rest/api/customer/byid/uid1@email.com with the cookie (e.g. curl localhost:9080/rest/api/customer/byid/uid1@email.com --cookie "sessionid=<your sessionid cookie>", or just visit the page in your browser if it has the cookie)
The same technique can be used to modify any arbitrary user as well.
To preface this: yes, I'm aware that this is a sample application that's not designed to be secure or anything like that (y'know, what with the auto-filled default values and everything). I just wanted to make sure that people who planned on using this application as inspiration for a real-world application would be aware of this issue.
By taking advantage of the
sessionidcookie given to users, any user is able to access any other user's information. This is because the application doesn't associate sessions with users.An example of exploiting this:
uid0@email.comsessionidcookie given by the server/rest/api/customer/byid/uid1@email.comwith the cookie (e.g.curl localhost:9080/rest/api/customer/byid/uid1@email.com --cookie "sessionid=<your sessionid cookie>", or just visit the page in your browser if it has the cookie)The same technique can be used to modify any arbitrary user as well.