full-disclosure - Ebay, Inc Bug Bounty - GoStoreGo Administrative Authentication Bypass to all online stores

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 12 Feb 2014 12:38:53 -0800
From: Mark Litchfield <mark@...uratary.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Ebay,
 Inc Bug Bounty - GoStoreGo Administrative Authentication Bypass to
 all online stores

This attack allowed for a cross store (so essentially unauthenticated, 
as we have not authenticated to our target store) privilege escalation 
attack creating an administrative user on any *.gostorego.com store.

As indicated by their own website, there are over 200,000 active 
stores.  This attack allows access to 200,000 x Customers x data = Y.  
Due to the nature of the attack, it would trivial to automate an attack 
that would give us an administrative account on each of these stores 
with a single GET request !!  Or you could simply have a great shopping 
experience.  Google search site:gostorego.com, find the items you want 
to purchase.  Create you admin account (or use stealth mode so all 
attacks are logged as the Store Owner), change the price then buy it or 
simply give yourself some store credit.

This vulnerability was reported to the eBay Enterprise Bug Bounty team 
on Sunday 9th February 2014.

They and the Magento engineering team put out a fix for this issue 
extremely quickly.  So pats on the back all around are deserved.  I 
tested the issue and tried a few work arounds, but the fix holds good.  
So I want to say a big thanks to them.

Full issue with screen shots can be found at http://www.securatary.com 
within the vulnerabilities section.

All the best

Mark Litchfield
www.securatary.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/