Indeed : Add Introduction video of any Job of any Employer on Indeed [ IDOR ] worth 2500$
Company Information :
Indeed, Inc. is an American worldwide employment website for job listings launched in November 2004. It is a subsidiary of Japan's Recruit Holdings. and is co-headquartered in Austin, Texas, and Stamford, Connecticut, with additional offices around the world.
Target Information :
https://evaluate.indeed.com
Technical Details of the Bug :
Overview of the Vulnerability
Given the type of IDOR within an application, an attacker could perform the following actions:
- Perform unauthorized operations, such as escalating their privileges within the application, or forcing a password change on a user’s account in order to takeover that account
- Gain direct access to files and manipulate the file system, such as uploading, downloading, adding, or deleting data, including other user’s data.
Description :
On Indeed any Employer can post a job. At the domain https://evaluate.indeed.com you have option of adding a Introduction video option where Employer can upload video where he can mention about the company , job etc.
Flow of Adding the Job is vulnerable to IDOR Attack. It's possible to add/update introduction video of any job on indeed.
Technical Flow :
First Request :
https://evaluate.indeed.com/create-evi-and-redirect/[Public_Job_ID]
In the above request Public_Job_ID is vulnerable to IDOR Attack.
After this request it will redirect to you https://avi.indeed.com/go/[UUID] where you can upload a video.
How to get a Job ID :
Job ID is public and sharable through invitation link.
Go to https://evaluate.indeed.com -- > settings -- > invitation settings and you can copy sharable invitation link.
In the invitation link there is Public Job ID. This ID is also available in source code of job application page.
The Impact is very serious here. First this attack can be done on any job on Indeed without the knowledge of owner.
Second job ID is public and IDOR can be done remotely without any user interaction.
Any Attacker can upload a malicious video Inappropriate and harmful content about the company and job through video.
Steps to Reproduce:
1.Login from victim account on https://employers.indeed.com/.
2.This account needs to be fully verified account so your job should be public and it should not be paused or flagged by indeed.
3.Post a new job with all details.
4.Now go to https://evaluate.indeed.com/ and your job will appear here.
5.Here you will see option of add intro video option.
6.When you click on add video option below request will be sent.
https://evaluate.indeed.com/create-evi-and-redirect/[Public_Job_ID]
7.Drop the request and don't upload anything.
8.Now login from attacker account.
9.Copy the above mentioned link in step 6.
10.You will notice that attacker will have access to the URL.
11.Now upload the video from attacker account.
Note : It takes 10-15 minutes to show once you upload it.
12.Now verify it from victim account.
13.When you will apply for this job from job application seeker account , this video will come at the end when you will submit your resume.
Business Impact:
Timeline :
April 04th 2023: Report send to Indeed product Security Team On Bugcrowd.
April 08th 2023: Report Accepted and Triaged.
May 19th 2023: Complete issue was resolved and confirmed.
May 19th 2023: 2500$ Bounty Rewarded
Comments
Post a Comment