{"id":2178,"date":"2025-01-28T17:05:19","date_gmt":"2025-01-28T17:05:19","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/28\/oauth-flaw-exposes-millions-to-account-hijacking-in-airline-travel-integration\/"},"modified":"2025-01-28T17:05:20","modified_gmt":"2025-01-28T17:05:20","slug":"oauth-flaw-exposes-millions-to-account-hijacking-in-airline-travel-integration","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/oauth-flaw-exposes-millions-to-account-hijacking-in-airline-travel-integration\/","title":{"rendered":"OAuth Flaw Exposes Millions to Account Hijacking in Airline Travel Integration"},"content":{"rendered":"\n<\/p>\n

Account Takeover Vulnerability in Popular Online Travel Service<\/strong><\/p>\n

By Ravie Lakshmanan, January 28, 2025<\/strong><\/p>\n

[Image: Airline Logo]<\/strong><\/p>\n

A recently patched account takeover vulnerability has been disclosed by cybersecurity researchers, affecting a popular online travel service for hotel and car rentals. The vulnerability allows attackers to gain unauthorized access to any user’s account, enabling them to impersonate the victim and perform various actions on their behalf.<\/p>\n

Exploiting the Vulnerability<\/strong><\/p>\n

The vulnerability can be exploited by sending a specially crafted link that can be propagated via standard distribution channels such as email, text messages, or attacker-controlled websites. Clicking on the link is enough for the threat actor to hijack control of the victim’s account as soon as the login process is complete.<\/p>\n

How the Attack Works<\/strong><\/p>\n

The attack method devised by Salt Labs involves redirecting the authentication response from the airline site, which includes the user’s session token, to a site under the attacker’s control by manipulating a "tr_returnUrl" parameter. This allows the attacker to access the victim’s account in an unauthorized manner, including their personal information.<\/p>\n

Impact and Risks<\/strong><\/p>\n

Successful exploitation of the vulnerability could have put millions of online airline users at risk. The attack method is difficult to detect through standard domain inspection or blocklist\/allowlist methods, making it a lucrative vector for API supply chain attacks.<\/p>\n

Security Implications<\/strong><\/p>\n

The vulnerability highlights the importance of stringent security protocols to protect users from unauthorized account access and manipulation. Salt Labs has described service-to-service interactions as a lucrative vector for API supply chain attacks, where an adversary targets the weaker link in the ecosystem to break into systems and steal private customer data.<\/p>\n

Prevention and Mitigation<\/strong><\/p>\n

To prevent and mitigate this vulnerability, it is essential to implement robust security measures, such as:<\/p>\n