Business

Vulnerability in Chess.com allowed access to 50 Million user records

Published

4 years ago

February 14, 2021

The vulnerability could have been exploited to access any account on the site including the Chess.com administrator account.

An IT security researcher identified a critical set of vulnerabilities in chess.com’s API, an immensely popular online chess playing site and app. The vulnerability could have been exploited to access any account on the site. It could also be used to gain full access to the site through its admin panel.

What Happened?

Cybersecurity researcher Sam Curry spent a lot of time finding vulnerabilities in Chess.com. The researcher started with finding generic vulnerabilities and stumbled upon a reflected XSS that could be exploited to drop backdoor to gain access to a victim’s account.

An IT security researcher identified a critical bug in the API of Chess.com; an immensely popular online chess playing site and app. The bug could have been exploited to access any account on the site. It could also be used to gain full access to the site through its admin panel. About Chess.com Chess.com is a huge platform for chess players with hundreds of thousands of players playing at any given time. The website hosts tens of millions of games per day. This shows that the site has a huge number of users and it is a very important place for chess fans. What Happened? Cybersecurity researcher Sam Curry spent a lot of time finding vulnerabilities in Chess.com. The researcher started with finding generic vulnerabilities and stumbled upon a reflected XSS that could be exploited to drop backdoor to gain access to a victim’s account. An attacker could also extract the “Connect to Google” URL and authenticate it with their own account and use an XSS hook and HTTP request that could bind a victim’s chess.com account to the attacker’s account. The “Account Takeover Vulnerability”, as explained by the researcher, was found when the subdomain for the API was found; “api.chess.com”. The researcher intercepted the HTTP traffic and noticed the API requests coming from this domain while using the app. The requests from the app to the API were signed and could not be tampered with easily but when the researcher searched a username for the purpose of sending a message. A request was sent to fetch the user’s information. This information contained the email address of the user. This makes it a vulnerability with medium severity. However, the actual vulnerability was the returned “session_id” as this was unique to each user and the session on the researcher’s computer. It was the authorization token that could let the researcher hijack any session. For further confirmation, the researcher hijacked the account of one of Chess.com's administrators Daniel Rensch and was able to access the administrative dashboard. At this point, the whole site was at their disposal. This would let the researcher take full control of any account on the site. Thankfully the researcher did not wish to attack Chess.com and was only working for academic purposes. The administration of chess.com was contacted and the bug was fixed within two hours. How to be safe? Although the bug is fixed, there are some practices that should be adopted to stay safe from any future attack. It is best practice to never use the same password for more than one site as a vulnerability of one site can make every account with the same email and password combination exposed.

An attacker could also extract the “Connect to Google” URL and authenticate it with their own account and use an XSS hook and HTTP request that could bind a victim’s chess.com account to the attacker’s account.

Account Takeover Vulnerability

The “Account Takeover Vulnerability”, as explained by the researcher, was found when the subdomain for the API was found; “api.chess.com”. The researcher intercepted the HTTP traffic and noticed the API requests coming from this domain while using the app.

The requests from the app to the API were signed and could not be tampered with easily but when the researcher searched a username for the purpose of sending a message. A request was sent to fetch the user’s information. This information contained the email address of the user. This makes it a vulnerability with medium severity.

However, the actual vulnerability was the returned “session_id” as this was unique to each user and the session on the researcher’s computer. It was the authorization token that could let the researcher hijack any session.

For further confirmation, the researcher wrote in a blog post that he hijacked the account of one of Chess.com’s administrators Daniel Rensch and was able to access the administrative dashboard. At this point, the whole site was at their disposal. This would let the researcher take full control of any account on the site.

Thankfully the researcher did not wish to attack Chess.com and was only working for academic purposes. The administration of chess.com was contacted and the bug was fixed within two hours.

How to be safe?

Although the bug is fixed, there are some practices that should be adopted to stay safe from any future attack. It is best practice to never use the same password for more than one site as a vulnerability of one site can make every account with the same email and password combination exposed.

About Chess.com

Chess.com is a huge platform for chess players with hundreds of thousands of players playing at any given time. The website hosts tens of millions of games per day. This shows that the site has a huge number of users and it is a very important place for chess fans.

Source: https://www.hackread.com/vulnerability-chess-com-50-million-user-records-accessed/?web_view=true

Post Views: 423