A vulnerability was recently discovered in the popular online course platform Coursera. The problem stemmed from the API, leading to the belief that hackers may have exploited the "BOLA" vulnerability to understand users' course preferences and bias their course choices.
Furthermore, it is also believed that the recently revealed vulnerabilities may have exposed user data before being patched. These flaws were discovered by researchers at the application security testing company Checkmarx and made public last week.
The vulnerabilities relate to a variety of Coursera's application programming interfaces , and the researchers decided to delve deeper into Coursera's security due to its growing popularity through the shift to online work and learning because of the COVID-19 pandemic.
For those who are unfamiliar with Coursera, you should know that this is a company that has 82 million users and works with more than 200 companies and universities. Notable partnerships include the University of Illinois, Duke University, Google, the University of Michigan, International Business Machines, Imperial College London, Stanford University, and the University of Pennsylvania.
Several API issues were discovered, including user/account enumeration via the password reset function, insufficient resources limiting both the GraphQL and REST APIs, and incorrect GraphQL configuration. In particular, a broken object-level authorization issue tops the list.
When interacting with the Coursera web application as regular users (students), we noticed that recently viewed courses were displayed in the user interface. To represent this information, we detect multiple API GET requests to the same endpoint: /api/userPreferences.v1/[USER_ID-lex.europa.eu~[PREFERENCE_TYPE}.
The BOLA API vulnerability is described as affecting user preferences. By exploiting this vulnerability, even anonymous users could retrieve preferences and even change them. Some preferences, such as recently viewed courses and certifications, also leak metadata. BOLA API flaws can expose endpoints that handle object identifiers, potentially opening the door to broader attacks.
«This vulnerability could have been abused to understand the course preferences of general users on a large scale, but also to skew users' choices in some way, as the manipulation of their recent activity affected the content presented on the home page Coursera for a specific user, ”the researchers explain.
"Unfortunately, authorization problems are quite common with APIs," say the researchers. “It is very important to centralize access control validations in a single component, well tested, continuously tested and actively maintained. New API endpoints, or changes to existing ones, should be carefully reviewed against their security requirements. "
The researchers noted that authorization problems are quite common with APIs and that as such it is important to centralize access control validations. Doing so must be through a single, well-tested, and ongoing maintenance component.
The discovered vulnerabilities were submitted to Coursera's security team on October 5. Confirmation that the company received the report and was working on it came on October 26. Coursera subsequently wrote to Cherkmarx stating that they had resolved the issues between December 18 and January 2, and then submitted a retest report with a new problem. Finally, on May 24, Coursera confirmed that all issues had been fixed.
Despite the fairly long time from disclosure to correction, the researchers said the Coursera security team was a pleasure to work with.
"Their professionalism and cooperation, as well as the swift ownership they assumed, is what we look forward to when engaging with software companies," they concluded.
Source: https://www.checkmarx.com