FirstBlood-#136Leaked invite ID allows anyone to register for an account.



On 2021-05-10, 0xblackbird reported:

Hi Zseano! I found out that anyone can register for an account because of a leaked invite code. This invite code was posted on a comment on Reddit.

Approach

A simple Google search reveals a comment on Reddit.

The one that posted this asked for assistance and (accidently) posted the invite code with it.

Now we can use this invite code on any other account. Correct me if I'm wrong but I think this itself is a business logic error.

Invite Code

F16CA47250E445888824A9E63AE445CE https://www.reddit.com/r/BugBountyHunter/comments/n4xzw1/firstbloodhackerscom_doctor_registration/

Steps to reproduce

  • Visit /register.php

  • Next, choose a username and paste in the invite code we found on Reddit and click on Secure Register.

  • Copy the password and visit /login.php or click on Continue to login.

  • Now enter your username and paste the password and click on Secure Login.

  • We successfully created and logged into the account :D!

Impact

We were able to create multiple accounts using one leaked invitation code. Normally, even if the code is leaked, it should check for which username it is generated. And because of this missing check, no validation is done and this works for any account we want to generate.

Have a nice day!

Kind regards, 0xblackbird

P2 High

Endpoint: /register.php

Parameter: inviteCode

Payload: F16CA47250E445888824A9E63AE445CE


FirstBlood ID: 15
Vulnerability Type: Auth issues

A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.


Respect Earnt: 2000000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.