Info of Millions of AliExpress Customers, Could Have Been Harvested, Due to Site Flaw

A Programming Flaw in the Code of Popular Online Marketplace, AliExpress, which Connects Small Chinese Businesses with International Buyers and has Over 7.7 Million Registered Users, has Endangered Each and Every One of Them as it Could Reveal their Names, Shipping Addresses and Phone Numbers to Anyone Who Knew Where to Look. Discovered by Israeli Security Researcher, Amitay Dan, the Insecure Direct Object Reference Vulnerability in Question, has been Reported to the Company behind the Website - Chinese e-Commerce Giant, Alibaba - and has been Fixed. The Vulnerability Allowed any Logged-In User to Access the Aforementioned Information about All the Other Users by Simply Changing the Value of the “mailingAddressId” Parameter on the URL of the mailingAddress.htm Page, Where this Information is Inputed and Changed.


After Sharing this Information with the Company and Israeli Media, he also Demonstrated the Attack for The Hacker News, which Confirmed the Existence of the Flaw. By Creating an Automated Script that Would Repeated Crawl the Page after Changing the Value of the “mailingAddressId” Parameter to All Possible Numbers between 1 and 99,999,999,999, an Attacker Could Have Easily Created a Huge Trove of Information that Could be Used for Scams and Frauds, or Sold on to Other Crooks. Perhaps Someone did so Already, Who Knows ? The Only Good News about this, is that, an Attacker Couldn't Access the Users' Login Credentials and Financial Information. Unfortunately, for Skillful Scammers, a Name and Phone Number is Often More than Enough.




Info Source:

http://thehackernews.com/2014/12/aliexpress-website-vulnerability_7.html