OPEN REDIRECT ON FIREBASE DYNAMIC LINK AFFECTING OVER 100 COMPANIES

 Hello guys,

I was looking at some javascript files of some website with a bug bounty program.we'll call it redacted.com

I grepped for http and https protocols.One of the https links that resembled  :https://redacted.page.link/?link=https://redacted.com

i immediately knew it was a firebase dynamic link and got curious with the second redacted.com url.After replacing the second url with google.com i got redirected to google.

Win! Open redirect confirmed.

Dynamic links are deeplinks that allow you to send an application user or potential users to any part of the application.

You can read about firebase dynamic link here https://firebase.google.com/docs/dynamic-links


I reported to the company and was paid in under 3 hours.

After that i remembered i had encountered some companies using firebase during my normal pentests and bug hunting so i decided to check the sites/app.

I decided to FUZZ all h1 programs for the misconfiguration.Fired burp intruder and replaced the first url with a wordlist containing h1 programs names.If i got 302 then the site was vulnerable to open redirect ,400 meant the company was not using firebase,404 meant the company had firebase dynamic link but it was not misconfigured.


I got 73 vulnerable programs and submitted 16 of them.

I looked for programs with open redirect in scope and submitted them.4 got paid.12 got closed as N/A and informative.

Woke up next day disappointed by the N/As from h1 and decided to look for the same misconfiguration on external programs.

With the help of google dorks and some script i wrote i got 3k programs.Using the same fuzzing techniques with the burp intruder i got 160 vulnerable companies.

I wrote a sample report template,replaced company names appropriately and Reported to all them.

Some companies considered it a LOW and paid as low as $50 ,others medium.some programs have not replied during the writing of this post.

FIX

Implement a whitelist of domains on the firebase console as described in the documentation.https://support.google.com/firebase/answer/9021429

Comments

Post a Comment

Popular posts from this blog

SOME BUGS

Image
 It's been  a while since i wrote anything related to bug bounty or hacking.In that time i have had some interesting and bad experiences with bug bounty programs.from fast responses to scam external  programs I won't be naming/ shaming the programs but soon i will put up a comprehensive list of scam programs to avoid. Let's talk about some of the bugs; 1. Authentication bypass via path normalization i was hunting on some match matching/dating site.after finding subdomains via crt.sh and fuzzing the subdomains with a wordlist.i found a login page;  min.site.com I started to fuzz to files with ffuf with a custom wordlist.with no result i looked for sqli but found non.tried response manipulation.again failed I was about to give up then i click on a png file.deleted the pic.png and got 403 error.using script https://github.com/iamj0ker/bypass-403 on it i  could list images on the server! https://login.site.com/images// I tried https://login.site.com// also https://...
Read more

Not A Guide to hacking betting sites

  DISCLAIMER!!!   This is for educational purposes only and not a guide to hacking betting sites. In this writeup i will try to provide some bugs i have found on betting sites during my almost 3years bug bounty journey.I have reported more than 100 vulnerabilities on betting websites and android application but i will only talk about some bugs.Sorry,I don't have screenshots to demonstrate the vulnerabilities so i will just list  some bugs and their impacts.I will not name the companies for obvious reasons The writeup lists some  vulnerabilities bug hunters can look for while hunting on betting platforms so grab some coffee and popcorn and enjoy! Some are interesting like  changing odds or withdrawing twice or withdrawing money more than your balance:) IDOR I found most of IDOR on betting sites on profile id parameters.some occurred on bet history where i could change user bet id history and get any user betting history on the site. SQLI Most of then were blind s...
Read more

Taking a Delorean car back to the future:Time related attacks

Image
After thinking about what to write about and having some ideas which are still half done and in draft.I decided to write this! As a car enthusiast with love for classic cars and passion for bringing back old cars to life. I would admit and hope my good friend mark whom we disagrees on most ideas are on the same page here.Delorean was a beauty.If you have not watched Back to the Future movies you are missing out. sit at the back left and let me drive you through time.oops! i forgot delorean is a two-passenger sports car ,but why not go to the future,2024 and get the new powerful delorean alpha5.A better looking super-fast,2+2 coupe , electric car. Enough with the car analogy,we as hackers love technical stuff,nevertheless i believe nowadays i am starting to appreciate the non-technical aspects,folks and roles in tech. In this blog i will discuss some attacks that could impact software from a time change.changing time to the future or back to the past could impact the normal working of ...
Read more