Home page logo

webappsec logo WebApp Sec mailing list archives

Ebay, Inc Bug Bounty - GoStoreGo Administrative Authentication Bypass to all online stores
From: Mark Litchfield <mark () securatary com>
Date: Wed, 12 Feb 2014 12:36:47 -0800

This attack allowed for a cross store (so essentially unauthenticated, as we have not authenticated to our target store) privilege escalation attack creating an administrative user on any *.gostorego.com store.

As indicated by their own website, there are over 200,000 active stores.This attack allows access to 200,000 x Customers x data = Y.Due to the nature of the attack, it would trivial to automate an attack that would give us an administrative account on each of these stores with a single GET request !!Or you could simply have a great shopping experience.Google search site:gostorego.com, find the items you want to purchase.Create you admin account (or use stealth mode so all attacks are logged as the Store Owner), change the price then buy it or simply give yourself some store credit.

This vulnerability was reported to the eBay Enterprise Bug Bounty team on Sunday 9^th    February 2014.

They and the Magento engineering team put out a fix for this issue extremely quickly.  So pats on the back all around 
are deserved.   I tested the issue and tried a few work arounds, but the fix holds good.  So I want to say a big thanks 
to them.

Full issue with screen shots can be found at http://www.securatary.com within the vulnerabilities section.

All the best

Mark Litchfield

This list is sponsored by Cenzic
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus

  By Date           By Thread  

Current thread:
  • Ebay, Inc Bug Bounty - GoStoreGo Administrative Authentication Bypass to all online stores Mark Litchfield (Feb 12)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]