Unauthorized User can View Subscribers of Other Users Newsletters
Team Summary
Official summary from LinkedIn
## Issue description A creator can create a newsletter, the followers can subscribe to the newsletter. The owner of the newsletter can view the subscriber list by clicking the "subscriber" button. Server-side authorization checks are missing on ``GET /voyager/api/voyagerPublishingDashSeriesSubscribers?decorationId=com.linkedin.voyager.dash.deco.publishing.SeriesSubscriberMiniProfile-2&count=10&q=contentSeries&seriesUrn=urn%3Ali%3Afsd_contentSeries%3A<NewsletterId>&start=0 HTTP/2"``. This gives an attacker the ability to view the subscriber list of other users' newsletters by replaying the vulnerable request using the victim ``NewsletterId``which is public. ## Steps: 1) Create a newsletter. 2) Open the newsletter and click on "subscriber". 3) Capture the vulnerable request. 4) Replay the vulnerable request using victim's ``NewsletterId``. 5) The response will disclose the subscriber list and their details in the API Response. ## Impact An attacker can view the subscriber list and details of other users' newsletters even though it is not possible through the application UI. by just replaying the vulnerable request with the victim's ``NewsletterId".
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Insecure Direct Object Reference (IDOR)