Up to this time, we’re able to launch the OkCupid mobile application making use of a deep website link, containing a malicious JavaScript rule when you look at the area parameter. The screenshot that is following the ultimate XSS payload which loads jQuery and then lots JavaScript code through the attacker’s server: (take note the top of area provides the XSS payload additionally the base section is the identical payload encoded with URL encoding):
The after screenshot shows an HTTP GET demand containing the last XSS payload (part parameter):
The host replicates the payload sent earlier within the day into the part parameter additionally the injected code that is javaScript performed into the context regarding the WebView.
As previously mentioned before, the ultimate XSS payload loads a script file through the attacker’s host. The loaded code that is javaScript be applied for exfiltration and account contains 3 functions:
- steal_token – Steals users’ verification token, oauthAccessToken, additionally the users’ id, userid. Users’ sensitive information (PII), such as for instance current email address, is exfiltrated also.
- steal_data – Steals users’ profile and data that are private choices, users’ characteristics ( e.g. responses filled during registration), and much more.
- Send_data_to_attacker – send the data collected in functions 1 and 2 into the attacker’s host.
steal_token function:
The event produces A api call to the host. Users cookies that are provided for the host considering that the XSS payload is performed into the context for the application’s WebView.
The host reacts having a vast json containing the users’ id while the verification token also:
Steal information function:
The event produces an HTTP request endpoint.
In line with the information exfiltrated within the function that is steal_token the request has been delivered because of the verification token while the user’s id.
The host reacts with all the current information about the victim’s profile, including e-mail, intimate orientation, height, household status, etc.
Forward information to attacker function:
The big event produces a POST request to your attacker’s host containing all the details retrieved in the function that is previous (steal_token and steal_data functions).
The after screenshot demonstrates an HTTP POST demand provided for the attacker’s host. The demand human anatomy 
contains all the victim’s painful and sensitive information:
Performing actions with respect to the target can be feasible as a result of exfiltration of this victim’s authentication token in addition to users’ id. These details is employed within the harmful JavaScript rule (just like used in the steal_data function).
An attacker can perform actions such as forward messages and alter profile data as a result of the information exfiltrated when you look at the steal_token function:
- Authentication token, oauthAccessToken, is employed into the authorization header (bearer value).
- Consumer id, userId, is added as needed.
Note: An attacker cannot perform complete account takeover considering that the snacks are protected with HTTPOnly.
the info exfiltrated into the steal_token function:
- Authentication token, oauthAccessToken, is employed within the authorization header (bearer value).
- Consumer id, userId, is added as needed.
Note: An attacker cannot perform complete account takeover considering that the snacks are protected with HTTPOnly.
Online System Vulnerabilities Mis-configured Cross-Origin Site Sharing Policy Contributes To Fragile Information Visibility
for the duration of the study, we now have discovered that the CORS policy associated with API host api.OkCupid.com is certainly not configured precisely and any beginning can deliver needs to your host and read its’ reactions. The request that is following a demand delivered the API host through the beginning
The host will not validate the origin properly and reacts utilizing the required information. Furthermore, the host reaction contains Access-Control-Allow-Origin: and Access-Control-Allow-Credentials: real headers:
As of this point on, we knew that individuals can deliver needs to your API host from our domain without being obstructed by the CORS policy.
The moment a target is authenticated on OkCupid application and browsing towards the attacker’s internet application, an HTTP GET request is delivered to containing the victim’s snacks. The server’s reaction contains A json that is vast containing the victim’s verification token and also the victim’s user_id.
We’re able to find a lot more helpful information in the bootstrap API endpoint – sensitive and painful API endpoints when you look at the API host:
The screenshot that is following painful and sensitive PII data exfiltration from the /profile/ API endpoint, making use of the victim’s user_id plus the access_token:
The after screenshot shows exfiltration associated with the victim’s communications through the /1/messages/ API endpoint, utilising the victim’s user_id plus the access_token:
Summary
the entire world of online-dating apps has developed quickly over the years, and matured to where it is at today with all the change to a world that is digital particularly in the past 6 months – considering that the outbreak of Coronavirus around the world. The “new normal” habits such as for example as “social distancing” have actually forced the dating globe to entirely depend on electronic tools for help.
The study delivered right right right here shows the risks related to one of many longest-established & most popular apps in its sector. The serious dependence on privacy and information safety becomes much more essential whenever a great deal personal and intimate information being stored, handled and analyzed within an software. The application and platform is made to create individuals together, but needless to say where individuals get, criminals follows, shopping for simple pickings.