Vulnerabilities in E-Commerce Solutions - Hunting on Big Apples

Vulnerability Intelligence

7 Aug 2022

WEB-appication security, vulnerability, bugs, payment systems

Resecurity is working on numerous penetration testing and red teaming exercises for major Fortune 500, the security used by web applications still remains one of the key components which often leaves the door wide open for attackers.

The exploitation of certain vulnerabilities by experienced bad actors may lead to fatal events which leads to a data breaches.

Such issues can be especially meaningful for online-services and e-commerce whom work with customers globally, this is also what creates a compliance risk.

Even big technology companies are affected by the insecurity of web applications and invest in timely identification of vulnerabilities to mitigate potential risks.

In this research post, Ahmad Halabi will share some of the recent vulnerability findings which have been timely reported to Apple Security for further patching. Similar issues have been identified on multiple projects providing online-shopping functions and e-commerce.

The Target

When you come across a big Asset like Apple or Microsoft, you have to know from where to start and what to check. For us, we were looking for a target that is considered an important asset to Apple and contains valuable private information so the bounty will be worthy.

For example: https://applepaysupplies.com/

apple pay supplies decal kit signage — https://applepaysupplies.com/

Apple Pay Supplies: allows you to order Apple related Kits such as `Apple Pay Decals Kit` and `Apple Pay Signage Kit`.

Studying The Application Structure

We began with checking the target website as a normal user who wants to order a kit. By turning on Burp Suite, we were able to intercept all the traffic of this website and proceeded with an order by navigating to `Place Order`.

After that we filled the Shipping Information and submitted the order.

The shipping Information included: Full name, Company, Address information (Country, City, Street, Zip code) and Phone Number.

There's a track order feature so after submitting your order you're able to track it.

To track the order, we have to put our email address and the order number that gets assigned once the order is created.

We noticed here two interesting variables that required investigation, Order Number and Email .

Identifying The Vulnerability - Chaining IDOR With Rate Limit Discloses Shipping Information.

1^st Step:

After hitting the Submit button to track the Order Status, the page showed my Order details, we noticed this URL in the browser tab:

https://applepaysupplies.com/trackorder?order_id=APP1162306&email=my.test.email@gmail.com&language_id=1

2^nd Step:

Here we thought about an IDOR vulnerability chained with a Rate Limit mechanism to guess the order_id of an Apple user, we already know the users email ID.

We start analyzing the order_id value: APP1162306 by generating multiple Orders and comparing their order_id values.

APP characters are fixed.
We have 7 numbers after APP which can be brute forced.

3^rd Step:

We then navigated to the target URL https://applepaysupplies.com/trackorder?order_id=APP1162306&email=my.test.email@gmail.com&language_id=1 but the surprising thing was how it displayed a blank page rather than the Order Details that were shown after hitting the Submit button.

We were not able to perform the attack by hitting Submit button nor were we able to intercept the request as the Application was using a front-end fetching mechanism via a JavaScript thus no backend request was related to the target URL. So, we needed to analyze the JavaScript Files / Burp History and check for an API to see how the data is being fetched and retrieved.

4^th Step:

After some Recon and Analysis, we found an API that interacts with the backend, it fetches the Order Information.

Alternative Request: https://applepaysupplies.com/api/Home/GetOrderStatus?orderno=APP1162306&email=my.test.email@gmail.com

This API Request is responsible for Fetching the Order Status Details.

5^th Step:

Now it was easy to proceed, we can now start generating 7 numbers wordlist to brute force the Order number in a numerical order to get the Valid Order Status Details.

Luckily there was no Rate Limit Protection in place so we could brute force the Order Number of any valid Apple User, we then disclose their Shipping Address Information.

Found Valid orderno and disclosed Shipping Information

Reporting

We made a detailed PoC and Reported this Vulnerability to Apple.
After a while, Apple Fixed the Vulnerability and Requested us to check the Fix.

Checking The Fix

Apple fixed the Vulnerability by removing the API call responsible for fetching the Order Status Details (/api/Home/GetOrderStatus). So now users can only use the main Functionality "Track Order".

Instead of the removed API endpoint, they used the Track Order request (https://applepaysupplies.com/trackorder?order_id=APP1162306&email=my.test.email@gmail.com) to fetch the status details.

However they enhanced the Track Order Functionality. They used CryptoJS Library to encrypt the values since now they are being sent and fetched from the Client Side.