Security Vulnerability : Broken Access Control

[zyyyxptrr]

Hello, I've found a Broken Access Control vulnerability.

The API endpoint for user data, specifically:

https://www.tanyaaja.in/api/user/by-slug/[username]

{
  "message": "Found the owner of the slug zzz",
  "data": {
    "name": "\"::><",
    "email": "[email protected]",
    "count": "3",
    "image": "https://lh3.googleusercontent.com/a/ACg8ocLzg3TQOz1WAOncO3vniPum-qKH6pF4EhMhdIWnposj4Sw=s96-c",
    "slug": "zzz",
    "uid": "zzz"
  }
}

This API URL is displaying user data, including their "uid."

I've also discovered another API endpoint:

https://www.tanyaaja.in/api/question/by-uid/[example]

{
  "message": "Found questions for user zzz",
  "data": [
    {
      "status": "Not started",
      "submitted_date": "2023-09-16T06:44:00.000+00:00",
      "question": "p p",
      "uid": "zzz",
      "uuid": "zzz"
    }
  ]
}

The "uid" parameter can be populated with data exposed in the previous request. This means that an attacker could access all questions belonging to other users and view the detailed account information of other users.

Broken Access Control vulnerabilities like this can pose a significant security risk, as they allow unauthorized access to sensitive data. It's important to address and fix this issue promptly to protect user privacy and data security.

[mazipan]

Thank you for raising the issue, almost all APIs are not use the proper session manager yet.
That's why it's still rely on the user parameter in many places.

I already prepared the better session management but maybe will take some times to rollout to the whole endpoint especially the private one.

I plan to do that for at least until the next week.

As an initial, I will remove the uid from the response, but of course it's not solving the root cause problems that impacting to all endpoints.

[zyyyxptrr]

Thank you for your appreciation, I am sure this project will be used by many people.

[mazipan]

This issue was partially closed.

Still there are some known issues but will be tackled later.