Imperva Red Team Discovers Vulnerability in TikTok That Can Reveal User Activity and Information

TL;DR

The Imperva Red Team discovered a vulnerability in TikTok, a popular social media platform with more than one billion users worldwide, that could allow attackers to monitor users’ activity on both mobile and desktop devices.

This vulnerability, which has now been fixed, was caused by a window message event handler that does not properly validate the message origin, providing attackers access to sensitive user information. In this blog post, we’ll examine how this vulnerability works and its potential implications for TikTok users.

Discovering the Vulnerability

In recent years, web applications have become increasingly complex, with developers leveraging various APIs and communication mechanisms to enhance functionality and user experience.

One area that has drawn our attention is message event handlers. Based on our experience, these handlers are often overlooked as potential sources of security vulnerabilities, even though they handle input from external sources.

What is the PostMessage API?

The PostMessage API, also known as the HTML5 Web Messaging API, is a powerful communication mechanism that enables secure cross-origin communication between different windows or iframes within a web application. It allows scripts from separate origins to exchange messages, overcoming the restrictions imposed by the Same-Origin Policy, which typically limits data sharing between different sources on the web.

The API consists of a method, window.postMessage(), and an event message. The postMessage() method is used to send a message from the source window to the target window or iframe, while the message event is triggered on the receiving end when a new message is received.

Analyzing TikTok’s Source Code for Message Event Handlers

The first step in discovering the vulnerability was to identify all the message event handlers in TikTok’s web application. This involved a comprehensive analysis of the source code in locating instances where the PostMessage API was being used.

Once all the message event handlers were identified, we proceeded to carefully read and understand the code for each handler. This allowed us to determine the purpose of each handler and evaluate the security implications of processing untrusted messages.

Identifying the Weak Link in TikTok’s User Tracking

During the code analysis, our team came across a script in TikTok’s web application that appeared to be involved in user tracking. Specifically, the script contained a message event handler responsible for processing incoming messages of type “simulator:verify.” It seemed that this handler was used for a client-side caching system.

Upon closer inspection, we noticed that this message event handler did not properly validate the origin of incoming messages, making it susceptible to exploitation by malicious actors. Additionally, the handler was found to send back sensitive user information in response to these messages, further exacerbating the risk.

The following is an excerpt from the vulnerable source code responsible for processing incoming messages and sending information back to the sender.

As demonstrated in the code snippet above, the receiveMessage function fails to verify the origin of the incoming message. The function also invokes the postVerify method, which sends back sensitive information, including the current TikTok URL and a list of events corresponding to various actions that can be performed on the platform. This information is sent to either the window.opener or window.parent, which could potentially be any website.

During our investigation, we also discovered that by redirecting the user to the /profile endpoint on TikTok, the platform automatically redirects the user to their profile page. This action inadvertently leaks the user’s TikTok username, compromising their privacy.

Exploiting the Vulnerability

By exploiting this vulnerability, attackers could send malicious messages to the TikTok web application through the PostMessage API, bypassing the security measures. The message event handler would then process the malicious message as if coming from a trusted source, granting the attacker access to sensitive user information.

Access to TikTok Users’ Information

Exploiting this vulnerability could allow attackers to gain access to various types of TikTok users’ information, including:

1. User’s device: Information about the user’s device, such as device type, operating system, and browser details, could be accessed by the attacker.
2. Videos viewed: Attackers could monitor which videos the user viewed on the platform, potentially revealing the user’s interests and preferences.
3. Duration of views: In addition to the videos viewed, attackers could also gather information about the duration of views, providing further insight into user behavior and engagement.
4. User’s account information: Personal information associated with the user’s TikTok account, such as username, videos, and other account details, could be exposed to the attacker.
   
5. Search queries: Another piece of information that could be leaked through this vulnerability is the user’s search queries. By accessing the TikTok URL, attackers could view the search terms the user has entered, revealing their interests and potentially sensitive information.

This information can be used for malicious purposes such as targeted phishing attacks, identity theft, or blackmail.

Conclusion

The Imperva Red Team notified TikTok of the vulnerability, which was promptly fixed. We would like to thank TikTok for their quick response and cooperation.

This disclosure serves as a reminder of the importance of proper message origin validation and the potential risks of allowing communication between domains without appropriate security measures.

It was a privilege to work together with the TikTok security team to help make TikTok a more secure platform for its users.