what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Alibaba Cloud Workspace 5.1.1-R-20220823.130855 Insecure Direct Object Reference

Alibaba Cloud Workspace 5.1.1-R-20220823.130855 Insecure Direct Object Reference
Posted Oct 31, 2022
Authored by Erwin Chan

Alibaba Cloud Workspace version 5.1.1-R-20220823.130855 suffers from an insecure direct object reference vulnerability that can allow for privilege escalation.

tags | advisory
SHA-256 | c49132fbd8ce971dfd0e86f26cf9ce6d696e6b615ed1cd11bbde476935598f7a

Alibaba Cloud Workspace 5.1.1-R-20220823.130855 Insecure Direct Object Reference

Change Mirror Download
# Exploit Title: Alibaba Cloud Workspace vulnerable to IDOR which lead to
account hijacking in a certain situation
# Date: 30/10/2022
# Exploit Author: Erwin Chan
# Vendor Homepage: https://www.alibabacloud.com/
# Software Link:
https://www.alibabacloud.com/product/cloud-desktop/download-client
# Version: Alibaba Cloud Workspace 5.1.1-R-20220823.130855
# Tested on: Windows 10

We found that Alibaba Cloud Workspace was vulnerable to insecure direct
object references ("IDOR") which lead to account hijacking in a certain
situation. Vender had confirmed that it was a "bug" instead of a
vulnerability and attempt to fix it in long term. Still, we considered that
this will introduce non-neglectable security ricks to end users. Hence, we
propose a measure to system admin in the following to mitigate the risk.

In Alibaba Cloud, end users could login to a workspace to control
corresponding cloud desktops. While a system admin could create various
workspaces, in their organization (or call it "tenant"), which allow users
login with different set of credentials and multi-factor authentication
("MFA"). We discovered that if different user accounts shared same username
(e.g., two accounts that share same username but different password,
different MFA and in different workspace), we could leverage one account
and alter the value of workspace ID in the traffic in order to hijack the
other account. The IDOR vulnerability allow an advisory who already
compromised one account of a workspace to further compromise an account
with same username of another workspace without knowing the password and
MFA verification.

Alibaba Cloud allow system admin to create workspace with enterprise AD
type. After a workspace of enterprise AD type was created, two domain
forests (i.e., “ecd.acs” and a domain setup by system admin ) and a domain
trust would be created and established respectively. It was observed that
“ecd.acs” may be used as management domain for system admin in some
enterprise. Thus, the IDOR vulnerability introduced a security risk which
allowing advisory to lateral move across different domains and potentially
escalate their privilege.

To mitigate the security risk that introduced by IDOR vulnerability, we
suggested system admin to create accounts with different username for each
workspaces. Vender had already plan to fix the bug in long term and may
consider to redact the domain “ecd.acs”.

Timeline:
Sep 16 2022 - we report the finding to Alibaba Cloud vender
Oct 12 2022 - Alibaba Cloud vender accept this as a bug instead of
vulnerability, and plan to fix it in long term

Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close