Today, I'm sharing a vulnerability I discovered in TikTok's bug bounty program. This vulnerability allows attackers to gain unauthorized access to victims' confidential campaign files.
TikTok enables brands to collaborate with creators by running ad campaigns. During the campaign creation process, users can upload attachments such as contracts, marketing materials, or other sensitive documents.
Exploit
I assumed the scenario where an attacker wants to access a victim's confidential campaign files. Here’s how the attack works:
1. The attacker creates a campaign, uploads a test file, and captures the request.
2. Using Burp Suite, the attacker intercepts the campaign creation request.
3. The attacker replaces their file_key with a victim’s file_key than send the request
4. To access your campaign details, start by navigating to the Campaign Details section within your dashboard. Once there, locate and click on the Campaign Summary option to view an overview of your campaign's key metrics. Finally, download or open the associated report by selecting the PDF file
5. But ,We are unable to access the file due to a restriction on the request made to
https://xxxx.tiktok.com/v/api/tool/resource/download/?file_key=fb871af7-434b-4cea-a55a-d5e015123ed4&&type=1&&filename=hacks.pdf
{"msg": "\u062e\u0637\u0623 \u0628\u0627\u0644\u0645\u0635\u0627\u062f\u0642\u0629 (10005)[20250106173321FC31697013AAD855E983]", "code": 10005}
6. After exploring other features, I discovered an option that allows campaign owners to share their campaign with a creator. To use this feature, the attacker must add their TikTok account as a creator.
7. The attacker logs into their account using a mobile device, accepts the invitation, and gains access to the campaign.
8. Once inside, clicking on the PDF file allows the attacker to access the victim's confidential document.
impcat
This vulnerability allows an attacker to gain unauthorized access to confidential campaign files uploaded by other users
