Researchers Say Chained Zapier Flaws Could Enable Account Takeover
Summary
Token Security researchers chained five Zapier flaws, using a free account to reach credentials, private software images and browser code, potentially enabling actions across users’ connected services. Zapier patched the flaws and reports no evidence of exploitation.
Key points
- Token Security researchers said a free Zapier account was enough to begin chaining five flaws; no malware or insider access was required.
- Researchers recovered credentials and accessed internal storage containing more than 1,100 private software images.
- One image contained a publishing key for code running in logged-in users’ browsers; a malicious update could enable acting as users and changing their automations.
- The researchers said attackers could use users’ existing integrations to send emails, move files or access connected services, though credentials for those services remained on Zapier’s servers.
- In a separate finding, researchers used a working key tied to an outside AI company’s CTO account to send an email from the executive’s Gmail account to a mailbox they controlled.
- Zapier patched the issues after disclosure, paid a $3,000 bounty and says it has no evidence the flaws were exploited. Researchers advised sensitive organizations to review automation logs and consider reauthorizing sensitive connections.
Article Details
- Attack Vectors
- Researchers reported chaining five flaws reachable from a free Zapier account, starting with a weakness in how users add code to automations.
- The researchers said they recovered credentials, accessed an internal storage system containing private software images, and found a publishing key for code running in logged-in users’ browsers.
- The researchers said the publishing key could have enabled a malicious update to that browser code, potentially allowing actions through users’ Zapier accounts and their approved integrations.
- Researchers also reported using a working key associated with an outside company executive’s personal account to send an email from the executive’s Gmail account to a mailbox they controlled.
- Defensive Notes
- Zapier patched the reported issues; the company said it found no evidence they had been exploited and that no further action was required.
- Researchers suggested organizations with heightened sensitivity review automation logs for activity they did not create and consider reauthorizing Zapier connections to particularly sensitive systems.