Week 14 - Algolia API Keys

Algolia API Misconfiguration

Today’s week 14 tip is centered around Algolia API hacking. In doing some research this week, I came across this vulnerability which I was previously unaware of:

Algolia API’s are basic REST API’s that use an AppID and API Key to define a client. Both are meant to be public and are visible to any attacker using a proxy tool like Burp Suite. As an attacker, you can directly retrieve the permissions for an API key using the below link:

APPID-dsn.algolia-net/1/keys/APIKEY?x-algolia-application-id=APPID&x-algolia-api-key=APIKEY

After filling in your clients APPID and APIKEY, this link will spit out the key’s permissions in JSON. Often, the keys will be misconfigured. If they are setup correctly, they should only have the ‘search’ permission. MANY times, they have other permissions like:

1. listIndexes -> Get list of all existing indexes -> Information Disclosure

2. editSettings -> Update Index settings -> Allows for Stored XSS

3. addObject -> Add or update records -> Could be used for defacement

4. logs -> Query the logs -> Information disclosure

As you can see, the impact of misconfigured Algolia API keys can be huge. The ‘listIndexes’ permission often results in the disclosure of internal company data stored within an Algolia index. The ‘editSettings’ permission is the worst case, as it allows an attacker to specify a JavaScript payload that is executed every time a search is called.

SRC: https://www.secjuice.com/api-misconfiguration-data-breach/