FirstBlood-#136 — Leaked invite ID allows anyone to register for an account.
This issue was discovered on FirstBlood v1.0.0
On 2021-05-10, 0xblackbird reported:
Hi Zseano! I found out that anyone can register for an account because of a leaked invite code. This invite code was posted on a comment on Reddit.
A simple Google search reveals a comment on Reddit.
The one that posted this asked for assistance and (accidently) posted the invite code with it.
Now we can use this invite code on any other account. Correct me if I'm wrong but I think this itself is a business logic error.
Steps to reproduce
Next, choose a username and paste in the invite code we found on Reddit and click on Secure Register.
- Copy the password and visit
/login.phpor click on Continue to login.
- Now enter your username and paste the password and click on Secure Login.
- We successfully created and logged into the account :D!
We were able to create multiple accounts using one leaked invitation code. Normally, even if the code is leaked, it should check for which username it is generated. And because of this missing check, no validation is done and this works for any account we want to generate.
Have a nice day!
Kind regards, 0xblackbird
FirstBlood ID: 15
Vulnerability Type: Auth issues
A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.