Microsoft patched a vulnerability on the Xbox website that let attackers obtain users’ email addresses by manipulating a gamertag-linked identifier stored in browser cookies, a security researcher reported.
How the flaw worked
Researcher Joseph “Doc” Harris discovered the issue on enforcement.xbox.com, the Microsoft site used by Xbox account holders to review enforcement actions and appeal penalties. After a user signs in, the site writes a session cookie to the browser to avoid repeated credential prompts.
That cookie contained a field for the Xbox User ID (XUID). According to Harris, the XUID value was stored without encryption, so he could open the browser cookie inspector, view the raw cookie data and replace the XUID with one from an account he controls.
When he swapped the XUID and refreshed the page, the site displayed the email address associated with the substituted XUID. “I tried replacing the cookie value and refreshing, and suddenly I could see other users’ emails,” Harris told ZDNet.
Patch and Microsoft’s response
Microsoft resolved the issue by encrypting the XUID stored in the cookie, Harris said. Despite the fix, the company did not classify the problem as eligible for a bug bounty payout.
An analyst at Microsoft’s Security Response Center who evaluates reported issues determined the vulnerability fell outside the scope of the rewards program, reasoning that it could not be leveraged to directly compromise an Xbox console or fully take over an account.
Security implications
Although Microsoft judged the flaw not to meet the program’s criteria, the exposure of email addresses remains a security concern. Harris noted that many people reuse the same email across services; an attacker with access to a user’s email could attempt phishing, account recovery attacks, or other malicious activity.
