Summary
Hello hunters! 👋 In this write-up, I will share a Business Logic Flaw I discovered in a major podcasting platform (redacted.com ). By manipulating a simple XML file (RSS Feed), I was able to bypass the ownership verification process and claim legitimate podcasts as my own. This allowed me to create duplicate entries and hijack the identity of famous podcasts on the platform. Let’s get into the details! 🚀 The Logic The target platform allows creators to submit their podcasts using an RSS Feed URL. To verify that you own the podcast, the system reads the itunes:email tag inside the RSS file and sends a verification code to that email. The mechanism:
- User submits RSS URL (e.g., mysite.com/feed.xml ). - System reads the XML
- System extracts email from itunes:emailowner@example.com</itunes:email> . - System sends a code to owner@example.com . The Bug The system failed to fingerprint the content of the podcast to check for duplicates. It trusted any RSS feed as long as the email inside matched the submitter’s account. Get Anas NadY’s stories in your inbox Join Medium for free to get updates from this writer. This means if I download a famous podcast’s RSS feed, change the email inside it to my email, and host it on a public cloud storage, the system treats it as a new, valid podcast owned by me. Steps to Reproduce Here is how I exploited this logic:
- Pick a Target I found a valid, already published podcast on redacted.com . I copied their legitimate RSS feed URL.
- Manipulate the Feed I downloaded the RSS XML file to my local machine. I opened it and modified two lines:
- Title: Changed it slightly (to avoid exact name matches).
- Email: Changed the
itunes:email
tag to MY email address (the one I used to sign up on the target site).
The Payload (RSS XML):