FirstBlood-#418 — Email of an appointment could be modified if cookie doctorAuthed is present
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-25, panya reported:
The site allows modifying only an appointment message on https://579a3c7897af-panya.a.firstbloodhackers.com/manageappointment.php?aptid=<apptid> page.
But if we add
doctorAuthedcookie with any value, an attacker could modify a user's email too.
Steps to reproduce:
- Make an appointment (
e575ffcd-db10-40c5-a79c-97de287de2c0id in our case).
- Modify the appointment via a request like this:
curl -X POST 'https://579a3c7897af-panya.a.firstbloodhackers.com/api/ma.php?success&aptid=e575ffcd-db10-40c5-a79c-97de287de2c0' -H 'csrf: 99215d4e-0ff3-4275' -H 'Cookie: doctorAuthed=1' -d 'message=test&id=e575ffcd-db10-40c5-a79c-97de287de2c0&[email protected]'
- Visit the appointment URL: https://579a3c7897af-panya.a.firstbloodhackers.com/manageappointment.php?success&aptid=e575ffcd-db10-40c5-a79c-97de287de2c0
The email of the appointment's user will be changed to
There should be proper validation of the given parameters in the
/api/ma.phpendpoint. Modification of an email should not be allowed, even with the
FirstBlood ID: 33
Vulnerability Type: Application/Business Logic
Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID
21 and whilst it was not possible to modify via integer, if the ID was known it would still work.