iTWire - Imperva red team discovered a vulnerability in TikTok that can reveal u...

Thursday, 04 May 2023 08:16

Imperva red team discovered a vulnerability in TikTok that can reveal user activity and information Featured

IThe Imperva Red Team recently discovered a vulnerability in TikTok that could allow attackers to monitor users' activity on both mobile and desktop devices.

The vulnerability, which has now been fixed, was caused by a window message event handler that did not properly validate the message origin, providing attackers access to sensitive user information.

The PostMessage API (also known as the HTML5 Web Messaging API) is a communication mechanism that enables secure cross-origin communication between different windows or iframes within a web application. The API (Application Programming Interface) allows scripts from separate origins to exchange messages, overcoming the restrictions imposed by the Same-Origin Policy, which typically limits data sharing between different sources on the web.

The API consists of a method, window.postMessage(), and an event message. The postMessage() method is used to send a message from the source window to the target window or iframe, while the message event is triggered on the receiving end when a new message is received.

According to the Imperva report, “the first step in discovering the vulnerability was to identify all the message event handlers in TikTok's web application. This involved a comprehensive analysis of the source code in locating instances where the PostMessage API was being used.

“Once all the message event handlers were identified, we proceeded to carefully read and understand the code for each handler. This allowed us to determine the purpose of each handler and evaluate the security implications of processing untrusted messages.”

During the code analysis, the team came across a script in TikTok's web application that appeared to be involved in user tracking. Specifically, the script contained a message event handler responsible for processing incoming messages of type "simulator:verify." It seemed that this handler was used for a client-side caching system.

Upon closer inspection, it was noticed that this message event handler did not properly validate the origin of incoming messages, making it susceptible to exploitation by malicious actors. Additionally, the handler was found to send back sensitive user information in response to these messages, further exacerbating the risk.

The following is an excerpt from the vulnerable source code responsible for processing incoming messages and sending information back to the sender.

As demonstrated in the code snippet above, the receiveMessage function fails to verify the origin of the incoming message. The function also invokes the postVerify method, which sends back sensitive information, including the current TikTok URL and a list of events corresponding to various actions that can be performed on the platform. This information is sent to either the window.opener or window.parent, which could potentially be any website.

During the investigation, it was also discovered that by redirecting the user to the /profile endpoint on TikTok, the platform automatically redirects the user to their profile page. This action inadvertently leaks the user's TikTok username, compromising their privacy.

By exploiting this vulnerability, attackers could send malicious messages to the TikTok web application through the PostMessage API, bypassing the security measures. The message event handler would then process the malicious message as if coming from a trusted source, granting the attacker access to sensitive user information.

Exploiting this vulnerability could allow attackers to gain access to various types of TikTok users' information, including:

• User's device: Information about the user's device, such as device type, operating system, and browser details, could be accessed by the attacker.
• Videos viewed: Attackers could monitor which videos the user viewed on the platform, potentially revealing the user's interests and preferences.
• Duration of views: In addition to the videos viewed, attackers could also gather information about the duration of views, providing further insight into user behavior and engagement.
• User's account information: Personal information associated with the user's TikTok account, such as username, videos, and other account details, could be exposed to the attacker.
• Search queries: Another piece of information that could be leaked through this vulnerability is the user's search queries. By accessing the TikTok URL, attackers could view the search terms the user has entered, revealing their interests and potentially sensitive information.
  This information can be used for malicious purposes such as targeted phishing attacks, identity theft, or blackmail.

The Imperva Red Team notified TikTok of the vulnerability, which was promptly fixed and Imperva would like to thank TikTok for their quick response and cooperation.

This disclosure serves as a reminder of the importance of proper message origin validation and the potential risks of allowing communication between domains without appropriate security measures.

Imperva created a video to explain the vulnerability. It’s available here. 

Read 522 times

GARTNER MARKET GUIDE FOR NDR 2022

DOWNLOAD NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

MORE INFO HERE!