BentBox.co Security Concerns

Please note that as of this writing, the majority of the problems discussed below have been addressed by the BentBox.co team. I will point out that they were fairly responsive and thankful for the issues that I presented them.

However there are still some of these problems that exist on their site.

On or around June 25th I discovered several security issues with the website BentBox.co. This website provides a platform for photographers and other artists to sell their work. I reached out to a well known security researcher whose name I wont mention until I get permission.

Following that individuals guidance I contacted the folks at BentBox.co where I provided them with the details of my findings. Over the course of the next few weeks we emailed a few times.

Below are the details of my findings.

BentBox.co vulnerability #

Overview #

Cookies are used to store session information. The cookies that are set contain 3 pieces of information:

1. PHPSessionId
2. Adult Content filter setting
3. User Id

It is possible to sign in with a valid user name and password to get a valid PHPSessionId and then edit the cookies stored locally to insert a different User Id in order to access another user’s private account information.

You can easily obtain any user’s user id value by browsing to one of their boxes and looking at the page source

<script type="text/javascript">var loggedinUserId="";var userId="";</script>

It is trivially simple to gain access to any user’s private information in this manner. In fact the entire website could be easily compromised with a simple script used to harvest user id’s.

What information is accessible? #

From my initial research it appears that everything related to a user’s account is accessible, including:

1. Private account settings
2. Private messages that have been sent / received
3. All boxes and their content
4. Payment Information

Other Information #

Another major issue is that the website does not use HTTPS by default. This means that every time the page is loaded the cookie’s containing the PHPSessionId value are transmitted in clear text. This is a major problem b/c it allows for trivial session hijacking.

How to Fix? #

Here are some of my suggestions on how to resolve this problem:

1. Enable HTTPS by default for ALL PAGES
2. Do not store the userId in the cookie, instead only the session id.
3. Map session Ids to the correct account in memory server side
4. Enforce access control checks on all page loads that verify that the session is still active and is valid for the account.
5. I would suggest not using that user’s Id anywhere in the page, but, it appears this would require significant work to achieve and may not be feasible.
6. Expire sessions after a shorter period of time.