> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Makuake: a 48-minute login defect swapped sessions with other users' accounts, affecting 3,916 accounts

After an auth flow change, login sessions were swapped with other users' accounts for about 48 minutes, so names, addresses, phone numbers and messages may have been seen.

Disclosed

2024-08-20

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It released a change to its internal authentication flow. From then on, some users' login state was swapped with that of other accounts for up to 10 minutes. [1]

  2. It learned of the problem from a user inquiry. It fixed the defect and forced all users to log out. The defect lasted until 16:01. [1]

  3. It announced the case, explaining that it came from an internal system change and not from a cyber attack or any external cause. [1] [2]

Impact

The swap affected 3,916 accounts. The user could possibly view or change the name, phone number, address, message contents and the last four digits and expiry of the registered credit card of the account swapped in. It said card data needed for payment was not at risk. One purchase made during a swap was found, and for card payment no processing under another person's name occurred. [1]

Timeline

  1. Started, Detected 2024-08-19
  2. Disclosed 2024-08-20
  3. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Postal address][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][Official]「Makuake」サイトのログイン不具合に関するご報告とお詫びMakuake, Inc. · 2024-08-20
  2. [2][News]「Makuake」サイトで約 48 分間ログイン不具合、別ユーザーが登録情報閲覧の可能性ScanNetSecurity · 2024-09-02 08:05