Attacker Can Make Other Pinner's Idea Pin Can't Be Commented And The Analytics On Idea Pin Page Can't Be Seen By The Owner

Disclosed by
pescobar
  • Engagement Pinterest
  • Disclosed date about 2 years ago
  • Points 10
  • Priority P3 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by pescobar

This vulnerability raised when attacker reacting idea pin with reaction_type number 10, after attacker reacting idea pin with reaction_type number 10 ( modify the request ), the idea pin can't be commented because the UI for commenting & analytics is gone.
Default reaction_type:

Good Idea: 7
Love: 1
Thanks: 13
Wow: 11
Haha: 5

The API allowed reaction_type with numbers: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14. But the actual reaction_type is just 5 numbers, which is above on the list. Maybe this vulnerability caused by non-existing of reaction_type.

Activity