Microsoft fixed a vulnerability on the Xbox website that allowed attackers to obtain users’ email addresses by altering a browser cookie tied to their gamertags, a security researcher reported.
How the flaw worked
Researcher Joseph Harris said the issue was discovered on enforcement.xbox.com. After a user logged in, the site created a session cookie in the browser to avoid requiring credentials again on subsequent accesses.
According to Harris, that cookie contained a field for the Xbox user ID that was stored without encryption. By inspecting the browser’s cookies, he accessed the cookie contents and replaced the stored user identification with someone else’s ID.
Result and fix
When the cookie’s ID was swapped, the site refreshed and displayed the email address associated with the substituted ID. Harris reported the vulnerability to Microsoft, which issued a patch to correct the problem.
