# Exploit Title: Alibaba Cloud Workspace vulnerable to IDOR which lead to
account hijacking in a certain situation
# Date: 30/10/2022
# Exploit Author: Erwin Chan
# Vendor Homepage: https://www.alibabacloud.com/
# Software Link:
https://www.alibabacloud.com/product/cloud-desktop/download-client
# Version: Alibaba Cloud Workspace 5.1.1-R-20220823.130855
# Tested on: Windows 10

We found that Alibaba Cloud Workspace was vulnerable to insecure direct
object references ("IDOR") which lead to account hijacking in a certain
situation. Vender had confirmed that it was a "bug" instead of a
vulnerability and attempt to fix it in long term. Still, we considered that
this will introduce non-neglectable security ricks to end users. Hence, we
propose a measure to system admin in the following to mitigate the risk.

In Alibaba Cloud, end users could login to a workspace to control
corresponding cloud desktops. While a system admin could create various
workspaces, in their organization (or call it "tenant"), which allow users
login with different set of credentials and multi-factor authentication
("MFA"). We discovered that if different user accounts shared same username
(e.g., two accounts that share same username but different password,
different MFA and in different workspace), we could leverage one account
and alter the value of workspace ID in the traffic in order to hijack the
other account. The IDOR vulnerability allow an advisory who already
compromised one account of a workspace to further compromise an account
with same username of another workspace without knowing the password and
MFA verification.

Alibaba Cloud allow system admin to create workspace with enterprise AD
type. After a workspace of enterprise AD type was created, two domain
forests (i.e., “ecd.acs” and a domain setup by system admin ) and a domain
trust would be created and established respectively. It was observed that
“ecd.acs” may be used as management domain for system admin in some
enterprise. Thus, the IDOR vulnerability introduced a security risk which
allowing advisory to lateral move across different domains and potentially
escalate their privilege.

To mitigate the security risk that introduced by IDOR vulnerability, we
suggested system admin to create accounts with different username for each
workspaces. Vender had already plan to fix the bug in long term and may
consider to redact the domain “ecd.acs”.

Timeline:
Sep 16 2022 - we report the finding to Alibaba Cloud vender
Oct 12 2022 - Alibaba Cloud vender accept this as a bug instead of
vulnerability, and plan to fix it in long term