In the spirit of tax day, I wanted to write about my experience in reporting a privacy vulnerability in the most popular tax preparation software on the market: Intuit’s TurboTax. I have been using TurboTax for quite a few years for my taxes and this year I found they offered an Android app. At first, I wondered if people really did taxes on their phone, though in Intuit’s defense, the app looks to be catered more towards tablets. Being that TurboTax contains some of my most sensitive data available, I decided to take a closer look into their app. This led to my discovery of a vulnerability allowing email account enumeration of every user in their system. Though not exactly a critical vulnerability, it was a privacy issue worth reporting and fixing nonetheless.
Capturing the web requests, I noticed an interesting call to fetch my user info:
The response is below:
It’s a common design pattern to use /me as a parameter in order to fetch the current user’s information, rather than specifying his userId . In these cases, the last URI segment will usually also accept a userId to provide access to profile information of other users in the app. The following URL (using my userId ) received the same response as above: https://accounts-tax.platform.intuit.com/v1/users/165140357 . Next, I wanted to see the response when requesting the information of other users. Decrementing this ID by one and performing the same request produced the following response:
The endpoint at least made a distinction between the logged in user and the userId being requested, though it still exposed the email address of every user in the system. Again, not an earth-shattering vulnerability but users typically don’t like their email addresses exposed for any malicious actor to harvest and use for spam.
I wrote the following PoC to demonstrate the exploit for Intuit’s security team:
I was impressed that Intuit actually had an official process for reporting security vulnerabilities, making it easy to contact the correct team to patch the issue.
Disclosure Timeline
2015-01-12: Initial report sent
2015-01-13: Received response requesting more details
2015-01-13: Sent detailed PoC (above)
2015-01-20: Received response that they’re validating the issue
2015-01-21: Received response asking for my output when running PoC
2015-01-21: Sent example output
2015-01-21: Acknowledgment of vulnerability, remediation in progress
2015-01-27: I follow up on status of fix
2015-01-31: Update received: mitigation controls in place, patch planned
2015-02-05: Update received: abuse monitoring in place, but patch still scheduled. No API abuse found.
2015-02-26: Update received: Fix released and confirmed
Intuit was extremely responsive during this process. The report came at their busiest time of the year and, while the full fix timeline may seem extended, they immediately took measures to monitor any abuse of the vulnerability. As Intuit explained, their objective was to keep customer data safe while making sure there was little service interruption to customers during the mitigation process. Intuit’s security team expressed their thorough appreciation for my report and added me to their Security Researcher Acknowledgements page.
The post Privacy Vulnerability in TurboTax’s API appeared first on xda-developers.