Unlocking Premium Download & Share Features via Client-Side Flag Tampering

 بِسْمِ اللَّهِ الرَّحْمَـٰنِ الرَّحِيمِ

اللَّهُمَّ صَلِّ وَسَلِّم وَبَارِكْ عَلَى نَبِيِّنَا مُحَمَّد

Hello Hunters 👋,

During one of my research sessions, I stumbled upon a very interesting client-side flaw on Private programm . What started as a quick test on a free account ended up unlocking premium-only features like Download and Share — just by flipping a flag in Burp Suite!

Let’s dive in 🚀

Summary

I found a vulnerability that allows free users to unlock premium-only features (Download, Share to Facebook, Share to Twitter) by simply tampering with a boolean flag (clientMatch) on the client side.

The backend failed to validate the subscription level, relying entirely on client input to decide whether the features should be enabled or not.

Discovery

I signed up for a free  account and started exploring the platform.

After uploading an image and right-clicking on it, I noticed the Download and Share options were present but locked — reserved for premium users.

That immediately caught my eye 👀.

“Are these restrictions just UI-based, or does the server actually enforce them?”

So, I fired up Burp Suite to test it out.

Exploiting the Flaw

Using Burp’s Match & Replace feature:

• Match: false

• Replace: true

I reloaded the page, and to my surprise…

💥 The Download and Share buttons lit up and became fully functional.

No subscription. No upgrade. Just one replaced word.

From there, I was able to:

• Download premium-edited images (revenue bypass ✅)

• Share them directly to Facebook and Twitter (entitlement bypass ✅)

The server completely trusted the manipulated flag and never checked whether my account was actually premium.

The Root Cause

The backend relied on a client-side flag (clientMatch) to determine entitlement instead of validating user privileges server-side.

This is a classic Improper Access Control / Business Logic flaw where the server assumes the client is “honest.” Spoiler: it never is.

Impact

• Revenue Loss: Free users can download premium-only content without paying.

• License Bypass: Paid-only content can be exfiltrated.

• Unauthorized Feature Use: Free users can share to Facebook/Twitter, abusing integrations.

CVSS Score

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N → 5.3 (Medium)

---

Conclusion

This vulnerability was simple but impactful. It highlights once again:

👉 Never trust the client.
👉 Authorization belongs on the server.

Alhamdulillah, it was a fun find and an easy win.

Until next time, happy hunting! 🐞

Unauthorized Access to TikTok Campaign Files

Today, I'm sharing a vulnerability I discovered in TikTok's bug bounty program. This vulnerability allows attackers to gain unauthorized access to victims' confidential campaign files.

TikTok enables brands to collaborate with creators by running ad campaigns. During the campaign creation process, users can upload attachments such as contracts, marketing materials, or other sensitive documents.

Exploit 

I assumed the scenario where an attacker wants to access a victim's confidential campaign files. Here’s how the attack works:

1. The attacker creates a campaign, uploads a test file, and captures the request.

2. Using Burp Suite, the attacker intercepts the campaign creation request.

3. The attacker replaces their file_key with a victim’s file_key than send the request 

4. To access your campaign details, start by navigating to the Campaign Details section within your dashboard. Once there, locate and click on the Campaign Summary option to view an overview of your campaign's key metrics. Finally, download or open the associated report by selecting the PDF file 

 

5. But ,We are unable to access the file due to a restriction on the request made to 

https://xxxx.tiktok.com/v/api/tool/resource/download/?file_key=fb871af7-434b-4cea-a55a-d5e015123ed4&&type=1&&filename=hacks.pdf

{"msg": "\u062e\u0637\u0623 \u0628\u0627\u0644\u0645\u0635\u0627\u062f\u0642\u0629 (10005)[20250106173321FC31697013AAD855E983]", "code": 10005}

6. After exploring other features, I discovered an option that allows campaign owners to share their campaign with a creator. To use this feature, the attacker must add their TikTok account as a creator. 

7. The attacker logs into their account using a mobile device, accepts the invitation, and gains access to the campaign.

8. Once inside, clicking on the PDF file allows the attacker to access the victim's confidential document.

 

impcat

This vulnerability allows an attacker to gain unauthorized access to confidential campaign files uploaded by other users