Team,

May you all be well on your side of the screen. :)

*. While Doing some research on thehttps://cal.com/, I was able to find a Pre-Account Takeover vulnerability.

Proof of concept:

*. I have created a video demonstration of the vulnerability and uploaded it to my Google Drive.

*. The link for the video is provided below for your review:

https://drive.google.com/file/d/15rHB1CNK1AvmtCL6eS7wXEA98wzEuql9/view?usp=sharing

Steps to Reproduce:

*. Go to the https://cal.com/

*. Try to create new account by using the victim email address.

Example:

*. My victim: testerheredaw@gmail.com

*. Once done with entering the needful details for signup, we were landed on the dashboard directly by using the victim email.

*. In attacker end attacker has victim email id and password to login on the https://cal.com/

*. Victim end, victim receiving email notification for account verification or something from thehttps://cal.com/ and victim checking it out.

*. Then, victim can try to login through the Google Oauth SSO, what happens here victim can directly land on the dashboard by using the SSO.

*. Which shows attacker end attacker can login through the victim email address and password, victim end victim can login through the Google Oauth SSO.

*. Since, Attacker and victim end same account was used on.

*. Until victim identifies this is attacker created account, and then until victim change the password and or adding Authenticator OTP, both of their ends the same account was accessed.

*. That's the issue and it shows the Account Takeover.

Solution:

*. Either don't let the user enter with Oauth when there's already another account created with the same email or let the user enter but let him know someone else has already created an account and if it was him or not then ask him to change the password.

*. First, clearly verify the Email OTP or link, then give the access to the dashboard.

*. The easiest remediation to this issue is to ensure that the email verification is adequately implemented and can not be bypassed.

*. Further, by ensuring that the social logins are correctly implemented, the email extracted from the social login is verified against the existing user’s database to ensure that the victim asked to reset the password.

*. By doing so, it is possible to remove the attacker’s persistence.

Impact

*. Victim Account Take Over.

*. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email.

*. This allows an attacker to gain pre-authentication to the victim’s account.

*. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing.

*. Hence, the attacker’s persistence will remain.

*. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor.

*. This attack becomes more interesting when an attacker can register an account from an employee’s email address.

*. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.