search

qiscus / qiscus-sdk-android

Qiscus provide everything you need to power up your app with chats. And it's now made simple.
https://www.qiscus.com
Apache License 2.0
201 stars 84 forks source link

Usage of Numeric IDs while creating a chat room #98

Closed BalvinderSingh23 closed 2 years ago

BalvinderSingh23 commented 2 years ago

Description: It has been observed that the application is using numeric IDs while creating a chat room. Benefitting this , if the application is vulnerable to improper authorization vulnerabilities then an attacker can quickly gather the data related to users by enumerating the numeric IDs

Recommendation for our side: Use UUDI’s instead of numeric ID’s while creating the room.

ariefnurputranto commented 2 years ago

Hi @BalvinderSingh23 ,

Thanks for your report,

Can you explain by lines of code, numeric ID's what do you mean while creating the room sir?