Airbnb – Web to App Phone Notification IDOR to view Everyone’s Airbnb Messages

发现 API

研究 js 文件,发现两个 api endpoint:

  • /api/v2/air_sms_notifications
  • /api/v2/air_push_notification

Call 这两个 API endpoint 需要符合以下条件:

https://www.airbnb.com/api/v2/air_sms_notifications

  • Requires that you have a verified phone number in your profile.
  • This API request allowed you to send yourself SMS texts.
  • There is a length limit on the SMS messages (160)
  • Throttling restrictions on SMS only allowed you to send this API request a h不应该andful of times every hour

https://www.airbnb.com/api/v2/air_push_notifications

  • Requires that you have a verified phone number, the Airbnb app installed on your phone (with that phone number), and you are logged into the app with that account. (This one took awhile to figure out)
  • Instead of sending SMS, it pushed notifications to your phone through the phone app.
  • There is no length restriction on the output.
  • No throttling which made testing a lot easier compared to SMS

POST data

文章没有交代如何找到 POST的 DATA

当发送 invalid 的 data 到server, server 会返回所有 valid 的template 名.

{"_format":"for_visitor","country":"USA","phone_number":"","template":"INVALID_TEMPLATE_NAME","user_id":,"title":"","body":"","metadata":{},"object_id":"","status":"","role":"","photo_url":""}

尝试其中的一个 valid template - custom. 发现 server 会返回error response,并提示那个 field 是缺失的.

{"error_code":400,"error_type":"validation","error_message":"There was an error processing the request.","error_id":"fd9fba9bc18538d7ae93ba6867c1be0a","error_details":"title is required."}

至此, 可以集齐所需的 POST DATA, 发送如下到 server, 即可往自己发送 SMS 或 notification.

{"_format":"for_visitor","country":"USA","phone_number":"","template":"custom","user_id":109764261,"status":"test","title":"test","body:"test"}

object_id

多数的template需要提供 object_id, 但我们并不知道, 不过我们可以 enumerate, 它只是一个简单的 ID. enumerate object_id 可以获取到所有 private message.

Wrap-up

  1. 不应该没有Throttling restrictions
  2. 不应该返回所有 template 的名字
  3. 不应该提示那个 field 缺失
  4. 不应该出现 IDOR (Insecure Direct Object References), 需要有权限控制

Ref

Airbnb – Web to App Phone Notification IDOR to view Everyone’s Airbnb Messages | Brett Buerhaus

Show Comments