Under Facebook’s responsible disclosure policy, this is being published with Facebook’s permission. Facebook and Tinder’s engineering teams quickly patched the vulnerabilities listed in this blog post. This post is about an account takeover flaw in Tinder’s application that I found. An attacker may have gained access to the victim’s Tinder account by manipulating this, since they would have used their phone number to log in. This may have been exploited by a bug in Facebook’s Account Kit, which the company recently fixed. Tinder’s web and mobile apps also enable users to log in with their mobile phone numbers. Account Kit is the company that provides this login service (Facebook).
When a user visits tinder.com and clicks on Login with Phone Number, they are redirected to Accountkit.com to log in. Account Kit sends the access token to Tinder for login if the authentication is successful. Interestingly, the Tinder API did not validate the client ID on the Account Kit token. This allowed the attacker to use any other app’s Account Kit access token to take over other users’ real Tinder accounts.
Account Kit is a Facebook product that allows users to easily register for and log in to certain registered apps using only their phone numbers or email addresses, eliminating the need for a password. It’s dependable, easy to use, and gives users the option of how they want to sign up for applications. Tinder is a mobile app that allows you to find and meet new people based on their location. It allows users to like or hate other users before initiating a conversation if both parties swiped right. An intruder may have obtained access to any user’s Account Kit account simply by using their phone number due to a flaw in Account Kit. When inside, the intruder could have received the user’s Account Kit access key, which is stored in their cookies (aks). After that, the attacker might use a weak API to log into the user’s Tinder account using the access token (aks).
How my exploit worked step-by-step:
The intruder must first log into the victim’s Account Kit account by using the API request below to enter the victim’s phone number in “new phone number.” Please bear in mind the Account Kit did not double-check the mapping of phone numbers to one-time passwords. After entering anyone’s phone number, the intruder might easily log into the victim’s Account Kit account. The intruder could then copy the victim’s “aks” Account Kit app access token from cookies.
The vulnerable Account Kit API:
POST /update/async/phone/confirm/?dpr=2 HTTP/1.1
new_phone_number=[vctim’s phone number]&update_request_code=c1fb2e919bb33a076a7c6fe4a9fbfa97[attacker’s request code]&confirmation_code=258822[attacker’s code]&__user=0&__a=1&__dyn=&__req=6&__be=-1&__pc=PHASED%3ADEFAULT&__rev=3496767&fb_dtsg=&jazoest=
Now the intruder simply sends the following request to the Tinder API, using the victim’s copied access token “aks.” They’ll gain access to the victim’s Tinder account. After that, the intruder will have total control over the victim’s account. They may, among other things, read private chats, view full personal information, and swipe other users’ profiles left or right.