- A travel service, integrated into many providers of carriers, transported a security error
- This can be abused to log in to people’s accounts and change their bookings
- It has since been reported and mitigated
A “popular, top-tier” travel service for hotel and car rental was vulnerable to a mistake that allowed malicious actors to take over anyone’s account, a new report from the API security company Salt Labs has claimed.
By abusing the error, they would be able to book hotel rooms, rent cars and change all booking information, easily. To make things worse, as the service is integrated into “dozens” by commercial airline’s online services, it would also allow misunderstandings to use the airline’s loyalty point and more.
Salt Labs said millions of people could be in danger, but that it did not want to say the name of the affected service.
Stealing session cookies
This is how a theoretical attack works: A malicious actor would create a specially difficult link and share it with the victim via usual channels (for example, email). The victim would click on the link, which led to the rental provider, who would ask it to log in with the credentials associated with the airline provider.
At that time, the rental platform generates another link and sends the victim back to the airline’s website to log in using OAUTH.
OAuth (Open Permission) is an open standard for secure access delegation that provides applications access to a user’s data on another service without postponing their credentials.
Due to the custom-built link, the approval response is returned to the striker, including the user’s session token, which gives them access to the platform.
“Since the manipulated link uses a legitimate customer domain (with manipulation that occurs only at parameter level rather than the domain level), does this attack -up.
Salt Labs revealed its findings to the affected service, which confirmed the error and implemented a solution.
