Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a critical vulnerability in the MatchPoint API. The issue involves improper authorization checks when handling user identity, potentially allowing unauthorized access to sensitive data such as personal and financial information, private messages, and access credentials. It could also enable attackers to impersonate users or alter account details. The main concern at this stage is confirming relevance and exposure.
- Unauthorized access to sensitive data and user accounts.
- Critical risk of data compromise and impersonation.
- Confirm relevance and assess potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending specially crafted requests to the MatchPoint API, leveraging the `actingasuser` HTTP header. Since the API does not properly validate authorization for the specified user, an attacker could manipulate sequential identifiers to impersonate any user, gaining access to sensitive information and performing unauthorized actions.
- No authentication or privileges required.
- Manipulating `actingasuser` header triggers vulnerability.
- Unauthorized access to data and account control.
Live Threat
Current exploitation, exposure, and threat context
The MatchPoint API's Insecure Direct Object Reference vulnerability could allow unauthorized access to sensitive personal, banking, and financial data, private messages, and physical access QR codes. Attackers could also impersonate users, modify third-party accounts, change passwords, and transfer virtual balances by manipulating sequential identifiers.
- Personal, banking, financial data at risk.
- Manipulate identifiers to access data.
- Unauthorized account modification and impersonation.
Operational Fix
Recommended remediation, mitigation, and detection steps
The MatchPoint API's handling of the `actingasuser` header without proper authorization checks presents a critical risk. This vulnerability could allow unauthorized access to sensitive data, including financial information and private messages, and enable malicious actions like account modification and user impersonation. Ownership likely falls to the application team responsible for the MatchPoint API, with coordination from infrastructure and security teams to identify affected systems and plan remediation. The first practical step is to inventory where the MatchPoint API is deployed, assess its internet-facing exposure, confirm business criticality, and identify the specific accountable owner.
- Application owners to lead remediation efforts.
- Verify API exposure and data sensitivity.
- Plan coordinated patching or mitigation.
