Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability
Program: reddit
Bug Type: IDOR
Bounty: 5000
Date: 2022-08-03
IDOR
Information-Disclosure
sensitive-data
broken-access-control
Summary
There was a vulnerability in reddit's GraphQL endpoint that enables any user to see moderator logs of any subreddit. The vulnerability could be reproduced by logging in as any user,
and sending a request to gql.reddit.com with the data - {"id":"6243efcbc61d","variables":{"subredditName":"any-subreddit"}}, This dumped the moderator logs of any subreddit the user mentions.
If the moderator logs had multiple pages, the response had a hasNextPage boolean key value pair indicating that. to see the next page take teh endCursor code value from the first response and simply add the variable "after": "code-from-endCursor".