SEC Consult Vulnerability Lab Security Advisory < 20160810-0 >
=======================================================================
              title: Multiple vulnerabilities
            product: LINE instant messenger platform
 vulnerable version: before June 2016
      fixed version: after June/July 2016
             impact: removed (as per bounty program policy)
           homepage: http://line.me/en/
              found: 2016-06-05
                 by: P. Morimoto (Office Bangkok)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Bangkok - Berlin - Linz - Montreal - Moscow
                     Singapore - Vienna (HQ) - Vilnius - Zurich

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"Line (styled "LINE") is a proprietary application for instant communications on
electronic devices such as smartphones, tablet computers and personal computers.
Line users exchange texts, images, video and audio, and conduct free VoIP
conversations and video conferences.

Line first launched in Japan in 2011, reaching 100 million users within eighteen
months and 200 million users only six months later. Line became Japan's largest
social network in 2013. In October 2014 Line announced that it had attracted
560 million users worldwide with 170 million active user accounts."

Source: https://en.wikipedia.org/wiki/Line_(application)


Business recommendation:
------------------------
SEC Consult recommends not to use this software until a thorough security
review has been performed by security professionals and all identified
issues have been resolved.


Vulnerability overview/description:
-----------------------------------
SEC Consult reported two security flaws that existed in the LINE messenger platform
to the LINE Security Bug Bounty Program.

1. Authorization Bypass
By abusing the authorization bypass vulnerability, an attacker was
able to gain unauthorized access to other user's confidential information.

2. Server-side request forgery
By abusing server-side request forgery issues, an attacker can make arbitrary
requests on behalf of the affected server and execute code remotely.

Further detailed information cannot be published as per LINE
bounty program policy. The severity rating has been excluded too.


Proof of concept:
-----------------
PoC has been removed due to the request from the vendor according to their
bounty program policy.


Vulnerable / tested versions:
-----------------------------
LINE instant messenger platform before June 5, 2016.


Vendor contact timeline:
------------------------
2016-06-05: Contacting vendor through https://bugbounty.linecorp.com/en/apply/
2016-06 & 2016-07: Vendor provides hot fixes to immediately correct the flaws
2016-07: LINE Security Team updates hall of fame 2016, special contribution
2016-08-10: Public advisory release

URL: https://bugbounty.linecorp.com/en/halloffame/2016/


Solution:
---------
The vulnerabilities have already been fixed in the latest version of LINE.


Workaround:
-----------
No workaround available


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Pichaya Morimoto / @2016