Loading HuntDB...

Password protected rooms total number of viewers disclosure to unauthorized members

Low
C
Chaturbate
Submitted None
Reported by batee5a

Vulnerability Details

Technical details and impact analysis

Information Disclosure
##Summary## Password protected rooms are supposed to be completely private, no information should be exposed if you do not have the room's password, and the UI looks like this. {F348826} However, through the following endpoint, It is possible to know the total number of viewers of the room even if it is password protected. https://chaturbate.com/contest/log/{Username}/ ## Steps To Reproduce: 1. Create a profile and add a Password to the room, lets say for testing purposes the username is "batee5a123" which is my test username. 2. Go to users and refresh the user list (Just to make sure your are synced) and see yourself there {F348830} 3. Open an Incognito instance in your web browser and visit the following endpoint: https://chaturbate.com/contest/log/batee5a123/ Or whatever your username is instead of "batee5a123", You'll find the total number of viewers there. {F348824} 4. For further testing, I made a second account and gave it the password and logged in, then from another browser instance I visited the same endpoint to see it is enumerating the total views and that it increased to 2 after joining with my other test account. {F348825} ## Impact Password protected rooms are supposed to be completely private with no exposure of any information what so ever, If even the least information exposed could be used in social engineering or blackmailing any chaturbate user. The correct response for this matter should be like this (always give zero): {F348823} Or show Unauthorized message.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Information Disclosure