FirstBlood-#72I can see & cancel other patients appointments



On 2021-05-09, thefawsec reported:

Description

To see one's appointment information and to modify/delete it, a complex UUID (which is given to a patient when they place an appointment) is required. A patient can enter their UUID at /yourappointments.php endpoint. I was able to actually Use numeric Ids, instead of UUIDs on that endpoint. In response I got the UUID of that particular patient's appointment. Then using that UUID I was able to cancel the patient's appointment.

The only thing that may make this bug a lower priority is the fact that attacker had to bruteforce the Id (but that is doable considering the fact that it is numeric Id and I also noticed that they are almost sequential, having gap of 100-200)

Steps to reproduce

  1. First, make an appointment so that you have a valid UUID for yourself.
  2. Go to the /yourappointments.php endpoint and enter your own UUID. Intercept this request using burp.
  3. Send this request to intruder and bruteforce the id parameter in the POST body with numeric values.
  4. Once you hit the correct Id, you will get an endpoint (with UUID).
  5. Go to that endpoint, you will see the information of patient, and now you can also cancel the appointment by pressing the cancel appointment button.

Note that to actually reproduce this faster, start you bruteforcing from the ID 56910219 as this was the first Id that I found. All other Id ( for existing patients and for new appointments) start after that ID.

How I was able to find those IDs?

Well as I was provided the admin creds, In the admin panel I realised that instead of UUIDs, simple numeric IDs are being used. With this information, I tried those numeric IDs on the /yourappointments.php endpoint and was able to get the result back, Here is the screen shot from the admin panel showing IDs of appointments:

Impact

This bug is not only leaking the PII of a patient, but also will lead to the cancellation of the appointment, all without the victim's interaction. Such Information is highly sensitive and is affecting the confidentiality & integrity of patient's data.

P2 High

Parameter:

Payload:


FirstBlood ID: 5
Vulnerability Type: IDOR

The endpoint QA.php (to query for an appointment) will allow for integer values to be used when querying for appointments. A bad cause of security through obscurity was attempted.


Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.