Vulnerabilities in the Feeld dating app

ghostpepper wrote: post #4

throwuxiytayq wrote: post #3

Criminal negligence levels of failure, especially given the category of app.

Wow you weren't kidding. These are vulns that would have been embarrassing a decade ago.

I think the timeline is the more damaging part too. Not only was their design woefully inadequate, they don't seem to care.

Re: Vulnerabilities in the Feeld dating app

#6

Post by a091 » Thu, Sep 12, 2024, 4:47 AM UTC

interesting read - anyone have pointers to other app pentesting walk throughs like this?

Re: Vulnerabilities in the Feeld dating app

#7

Post by Cu3PO42 » Thu, Sep 12, 2024, 4:53 AM UTC

It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere.

While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit.

Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community at large what needs to be done, but getting everyone to apply this consistently is... not so easy.

Re: Vulnerabilities in the Feeld dating app

#8

Post by MaxDorkroom » Thu, Sep 12, 2024, 4:53 AM UTC

[flagged]

Re: Vulnerabilities in the Feeld dating app

#9

Post by mjg59 » Thu, Sep 12, 2024, 4:59 AM UTC

a091 wrote: post #6

interesting read - anyone have pointers to other app pentesting walk throughs like this?

I wrote up finding some of these issues entirely independently: https://mjg59.dreamwidth.org/70061.html

Re: Vulnerabilities in the Feeld dating app

#10

Post by [deleted] » Thu, Sep 12, 2024, 5:02 AM UTC

MaxDorkroom wrote: post #8

[flagged]

[deleted]