To preface this: yes, I'm aware that this is a sample application that's not designed to be secure or anything like that (y'know, what with the auto-filled default values and everything). I just wanted to make sure that people who planned on using this application as inspiration for a real-world application would be aware of this issue.
By taking advantage of the sessionid cookie given to users, any user is able to access any other user's information. This is because the application doesn't associate sessions with users.
An example of exploiting this:
- Log into the application as
uid0@email.com
- Grab the
sessionid cookie given by the server
- Send a request to
/rest/api/customer/byid/uid1@email.com with the cookie (e.g. curl localhost:9080/rest/api/customer/byid/uid1@email.com --cookie "sessionid=<your sessionid cookie>", or just visit the page in your browser if it has the cookie)
The same technique can be used to modify any arbitrary user as well.
To preface this: yes, I'm aware that this is a sample application that's not designed to be secure or anything like that (y'know, what with the auto-filled default values and everything). I just wanted to make sure that people who planned on using this application as inspiration for a real-world application would be aware of this issue.
By taking advantage of the
sessionidcookie given to users, any user is able to access any other user's information. This is because the application doesn't associate sessions with users.An example of exploiting this:
uid0@email.comsessionidcookie given by the server/rest/api/customer/byid/uid1@email.comwith the cookie (e.g.curl localhost:9080/rest/api/customer/byid/uid1@email.com --cookie "sessionid=<your sessionid cookie>", or just visit the page in your browser if it has the cookie)The same technique can be used to modify any arbitrary user as well.