full-disclosure - [FD] Alibaba Cloud Workspace vulnerable to IDOR which lead to account hijacking in a certain situation

Open Source and information security mailing list archives

Message-ID: <CAKWichuipkceyPpg-aaQrE+GNPHjhbGq=QHQJW1gwAgLd5pJ1g@mail.gmail.com>
Date: Mon, 31 Oct 2022 00:00:48 +0800
From: chan chan <siuchunc.03@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Alibaba Cloud Workspace vulnerable to IDOR which lead to
 account hijacking in a certain situation

# Exploit Title: Alibaba Cloud Workspace vulnerable to IDOR which lead to
account hijacking in a certain situation
# Date: 30/10/2022
# Exploit Author: Erwin Chan
# Vendor Homepage: https://www.alibabacloud.com/
# Software Link:
https://www.alibabacloud.com/product/cloud-desktop/download-client
# Version: Alibaba Cloud Workspace 5.1.1-R-20220823.130855
# Tested on: Windows 10

We found that Alibaba Cloud Workspace was vulnerable to insecure direct
object references ("IDOR") which lead to account hijacking in a certain
situation. Vender had confirmed that it was a "bug" instead of a
vulnerability and attempt to fix it in long term. Still, we considered that
this will introduce non-neglectable security ricks to end users. Hence, we
propose a measure to system admin in the following to mitigate the risk.

In Alibaba Cloud, end users could login to a workspace to control
corresponding cloud desktops. While a system admin could create various
workspaces, in their organization (or call it "tenant"), which allow users
login with different set of credentials and multi-factor authentication
("MFA"). We discovered that if different user accounts shared same username
(e.g., two accounts that share same username but different password,
different MFA and in different workspace), we could leverage one account
and alter the value of workspace ID in the traffic in order to hijack the
other account. The IDOR vulnerability allow an advisory who already
compromised one account of a workspace to further compromise an account
with same username of another workspace without knowing the password and
MFA verification.

Alibaba Cloud allow system admin to create workspace with enterprise AD
type. After a workspace of enterprise AD type was created, two domain
forests (i.e., “ecd.acs” and a domain setup by system admin ) and a domain
trust would be created and established respectively. It was observed that
“ecd.acs” may be used as management domain for system admin in some
enterprise. Thus, the IDOR vulnerability introduced a security risk which
allowing advisory to lateral move across different domains and potentially
escalate their privilege.

To mitigate the security risk that introduced by IDOR vulnerability, we
suggested system admin to create accounts with different username for each
workspaces. Vender had already plan to fix the bug in long term and may
consider to redact the domain “ecd.acs”.

Timeline:
Sep 16 2022 - we report the finding to Alibaba Cloud vender
Oct 12 2022 - Alibaba Cloud vender accept this as a bug instead of
vulnerability, and plan to fix it in long term
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives