Permission Bypass in Explicit Media Endpoints leading to Private Message Leakage

Disclosed by
darkerink
  • Engagement Undisclosed
  • Disclosed date 10 months ago
  • Reward $2,000
  • Priority P2 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by customer

This vulnerability allowed viewing message contents from messages containing an embed or media attachment without authorization. The message and channel IDs were required to request an explicit media scan; however, knowledge of both IDs is not seen as a severity-lowering factor.

Summary by darkerink

A broken access control vulnerability was discovered in the Explicit Media scanning endpoints. By using said endpoints, an attacker could bypass VIEW_CHANNEL and READ_MESSAGE_HISTORY permissions to receive message objects from channels, DM channels, or threads they were not authorized to access.

The vulnerability relied on a separate core part to receive message IDs. By polling /guilds/:guidlId/channels, attackers would be able to receive last_message_id's, which was updated live as users sent new messages.

Once the attacker has the message IDs they want, they could send a PATCH request to /messages/explicit-media with a body of

{
  "messages": [
    {
      "message_id": "...",
      "channel_id": "..." 
    }
  ]
}

Which sent MESSAGE_UPDATE events to themselves via the gateway.

Activity