Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT
不安全的直接对象引用 / IDOR / #909863
该报告还没有中文解读。
原文摘录
摘自原文（4845 字符中的一小部分）
Using the Shopify ping application a user can communicate with the kit. The kit is an application that creates tasks based on the information supplied through the Shopify ping app by a user. With a few quick messages to Kit using Shopify Ping, a user can create a discount code and promote it, start …
原文中的代码
POST /api/v1/arro_token?access_token=███████&myshopify_domain=alwayzhack.myshopify.com&id=42668326968 HTTP/1.1 Host: www.kitcrm.com Content-Type: application/json Cookie: Connection: close Accept: application/json X-DeviceID: User-Agent: Shopify Ping/iOS/2.5.4 (iPhone12,3/com.shopify.ping/13.1.1) …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @sandeep_rj49 · 版权归作者与 Shopify 所有