[Writeup][Bug Bounty][Instagram] Instagram Still Send New DMs and Video Calls to Device After Logout [ID][EN]

- 2 mins

Description

Setelah pengguna melakukan logout akunnya, session seharusnya di invalidate untuk menghentikan aksi yang membutuhkan otentikasi seperti menerima notifikasi pesan yang masuk. Pada postingan ini membahas tentang Instagram yang menampilkan notifikasi pesan masuk walaupun pengguna telah mengakhiri session akunnya.

After the user logs out of his account, the session should be invalidated to stop actions that require authentication such as receiving notifications of incoming messages. This post is about Instagram, which shows incoming message notifications even though the user has ended his account session. —-

Impact

Attacker masih bisa mendapatkan notifikasi pesan yang masuk ke akun korban walaupun sessionnya sudah diakhiri.

The attacker can still get notification of messages that go to the victim’s account even though the session has ended. —-

Steps to Reproduce


Timeline


Muhammad Thomas Fadhila Yahya

Muhammad Thomas Fadhila Yahya

A man who believes in Hogwarts and Wakanda

comments powered by Disqus
rss facebook twitter github gitlab youtube mail spotify lastfm instagram linkedin google google-plus pinterest medium vimeo stackoverflow reddit quora quora