# Exploit Title: Alibaba Cloud Workspace vulnerable to IDOR which lead to account hijacking in a certain situation # Date: 30/10/2022 # Exploit Author: Erwin Chan # Vendor Homepage: https://www.alibabacloud.com/ # Software Link: https://www.alibabacloud.com/product/cloud-desktop/download-client # Version: Alibaba Cloud Workspace 5.1.1-R-20220823.130855 # Tested on: Windows 10 We found that Alibaba Cloud Workspace was vulnerable to insecure direct object references ("IDOR") which lead to account hijacking in a certain situation. Vender had confirmed that it was a "bug" instead of a vulnerability and attempt to fix it in long term. Still, we considered that this will introduce non-neglectable security ricks to end users. Hence, we propose a measure to system admin in the following to mitigate the risk. In Alibaba Cloud, end users could login to a workspace to control corresponding cloud desktops. While a system admin could create various workspaces, in their organization (or call it "tenant"), which allow users login with different set of credentials and multi-factor authentication ("MFA"). We discovered that if different user accounts shared same username (e.g., two accounts that share same username but different password, different MFA and in different workspace), we could leverage one account and alter the value of workspace ID in the traffic in order to hijack the other account. The IDOR vulnerability allow an advisory who already compromised one account of a workspace to further compromise an account with same username of another workspace without knowing the password and MFA verification. Alibaba Cloud allow system admin to create workspace with enterprise AD type. After a workspace of enterprise AD type was created, two domain forests (i.e., “ecd.acs” and a domain setup by system admin ) and a domain trust would be created and established respectively. It was observed that “ecd.acs” may be used as management domain for system admin in some enterprise. Thus, the IDOR vulnerability introduced a security risk which allowing advisory to lateral move across different domains and potentially escalate their privilege. To mitigate the security risk that introduced by IDOR vulnerability, we suggested system admin to create accounts with different username for each workspaces. Vender had already plan to fix the bug in long term and may consider to redact the domain “ecd.acs”. Timeline: Sep 16 2022 - we report the finding to Alibaba Cloud vender Oct 12 2022 - Alibaba Cloud vender accept this as a bug instead of vulnerability, and plan to fix it in long term