Business logic error occurs by altering the letters from lowercase to uppercase only !!
السلام عليكم , بسم الله والصلاه والسلام علي رسول الله سيدنا محمد
Hello, hackers. I and my friend karemelsqary have discovered a Business logic error on bug bounty program on HackerOne by simply changing the letters from lowercase to uppercase only !!
Let’s begin the story.
The target (example.com) allows users to create organizations and invite others to join them.
Notice that Creating an organization generates a slug (the wild card), which functions as a subdomain. For example, if the organization’s slug is “h1” , it will be accessed via https://h1.example.com.
The roles the owner can assign to invited users are: owner, manager, member, and billing.
Notice that Only owner and manger can change the slug, which changes the organization’s subdomain. So what happens if other roles try to change the slug , checking the access control. Unfortunately, access control for this process is secure.
So Let’s focus only on owner and manager role.
After that We thought what if we try to change our organization's slug to one already in use by another organization. Let’s suppose that our org’s slug is “h5-tf” and the one already in use by another organization is “hm-af”
Unfortunately , We got 400 Bad Request “This slug already is used”
After some time by Allah’s grace , We thought what if we change the slug letters from lowercase to uppercase like from “hm-af” to “HM-AF”
Get Abdelrahman Ammar’s stories in your inbox
Join Medium for free to get updates from this writer.
Bingooo , 200 Ok and the slug is actually changed to “HM-AF”
After that We refreshed the browser to see what happened and We were surprised that we have been redirected https:// hm-af.example.com (login page). we tried to login but we failed because we are not members of org that has slug “hm-af” instead we are members of org that has slug “HM-AF”
I know that you are confused now so let’s clarify some things
After changing our organization’s slug from “h5-tf” to “HM-AF” , the system now contains two organizations with slugs “HM-AF”(we own) and “hm-af”.
Each organization has a unique access URL; our organization’s URL is https://HM-AF.example.com, and another’s is https://hm-af.example.com.
So finally we understood The system redirects us to https://hm-af.example.com for login, even when we enter https://HM-AF.example.com as the URL , causing denying access for our org.
The root cause of this bug is:
Lacking for validation on parameter slug , the system should force you to use only lowercase letters which is happened after resolution of the bug
The attack scenario is as following:
The owner (victim) will create an org and invite a user with a manager role (attacker). the manager can use this bug to deny access to all users in the organization, including the owner.
Impact: denying access to all users in the organization, including the owner.
Thanks For Reading.
وأخير , الحمد الله علي كل شئ ومش تنسوا تدعوا لاخوتنا المستضعفين في فلسطين والسودان وجميع الدول الاسلاميه بالنصر وصلاح الحال
