Vulnerabilities Could Have Allowed Hackers to Change Passwords of TikTok Accounts
A researcher has earned nearly $4,000 from TikTok after discovering a couple of vulnerabilities that could have been chained to hijack accounts.
Muhammed Taskiran, a 20-year-old researcher based in Germany, informed TikTok in late August that a URL parameter on tiktok.com was “reflecting its value without being properly sanitized.”
This introduced a reflected cross-site scripting (XSS) vulnerability that could have been chained with a cross-site request forgery (CSRF) flaw discovered by Taskiran.
The CSRF issue affected an endpoint that enabled the researcher to set a new password for accounts that had used third-party apps to sign up to the social media service. An attacker could have exploited the vulnerabilities to change an account’s password simply by getting the targeted user to click on a malicious link.
“I combined both vulnerabilities by crafting a simple JavaScript payload – triggering the CSRF – which I injected into the vulnerable URL parameter from earlier, to archive a ‘one click account takeover’,” Taskiran explained in a report submitted to TikTok via the HackerOne platform.
TikTok classified the issue as “high severity” and awarded the researcher $3,860 for his findings. The company has partially disclosed the vulnerability report — very few technical details have been shared.
Taskiran also reported two other vulnerabilities to TikTok in recent months, including one that earned him just over $500.
TikTok is offering between $1,700 and $6,900 for high-severity vulnerabilities and between $6,900 and $14,800 for critical vulnerabilities. The company has to date paid out more than $80,000 for 85 vulnerability reports submitted through its recently launched bug bounty program.
The United States government has been trying to ban TikTok due to national security concerns, but the Chinese company is not backing off and it has already won some legal battles.
Related: TikTok and WeChat: Chinese Apps Dogged by Security Fears