SEC Consult Vulnerability Lab Security Advisory < 20160810-0 > ======================================================================= title: Multiple vulnerabilities product: LINE instant messenger platform vulnerable version: before June 2016 fixed version: after June/July 2016 impact: removed (as per bounty program policy) homepage: http://line.me/en/ found: 2016-06-05 by: P. Morimoto (Office Bangkok) SEC Consult Vulnerability Lab An integrated part of SEC Consult Bangkok - Berlin - Linz - Montreal - Moscow Singapore - Vienna (HQ) - Vilnius - Zurich https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Line (styled "LINE") is a proprietary application for instant communications on electronic devices such as smartphones, tablet computers and personal computers. Line users exchange texts, images, video and audio, and conduct free VoIP conversations and video conferences. Line first launched in Japan in 2011, reaching 100 million users within eighteen months and 200 million users only six months later. Line became Japan's largest social network in 2013. In October 2014 Line announced that it had attracted 560 million users worldwide with 170 million active user accounts." Source: https://en.wikipedia.org/wiki/Line_(application) Business recommendation: ------------------------ SEC Consult recommends not to use this software until a thorough security review has been performed by security professionals and all identified issues have been resolved. Vulnerability overview/description: ----------------------------------- SEC Consult reported two security flaws that existed in the LINE messenger platform to the LINE Security Bug Bounty Program. 1. Authorization Bypass By abusing the authorization bypass vulnerability, an attacker was able to gain unauthorized access to other user's confidential information. 2. Server-side request forgery By abusing server-side request forgery issues, an attacker can make arbitrary requests on behalf of the affected server and execute code remotely. Further detailed information cannot be published as per LINE bounty program policy. The severity rating has been excluded too. Proof of concept: ----------------- PoC has been removed due to the request from the vendor according to their bounty program policy. Vulnerable / tested versions: ----------------------------- LINE instant messenger platform before June 5, 2016. Vendor contact timeline: ------------------------ 2016-06-05: Contacting vendor through https://bugbounty.linecorp.com/en/apply/ 2016-06 & 2016-07: Vendor provides hot fixes to immediately correct the flaws 2016-07: LINE Security Team updates hall of fame 2016, special contribution 2016-08-10: Public advisory release URL: https://bugbounty.linecorp.com/en/halloffame/2016/ Solution: --------- The vulnerabilities have already been fixed in the latest version of LINE. Workaround: ----------- No workaround available Advisory URL: ------------- https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Bangkok - Berlin - Linz - Montreal - Moscow Singapore - Vienna (HQ) - Vilnius - Zurich About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/Career.htm Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/About/Contact.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Pichaya Morimoto / @2016