Hello hunters! 👋

In this write-up, I will share a Business Logic Flaw I discovered in a major podcasting platform (redacted.com).

By manipulating a simple XML file (RSS Feed), I was able to bypass the ownership verification process and claim legitimate podcasts as my own. This allowed me to create duplicate entries and hijack the identity of famous podcasts on the platform.

Let’s get into the details! 🚀

The Logic

The target platform allows creators to submit their podcasts using an RSS Feed URL. To verify that you own the podcast, the system reads the <itunes:email> tag inside the RSS file and sends a verification code to that email.

The mechanism:

1. User submits RSS URL (e.g., mysite.com/feed.xml).
2. System reads the XML
3. System extracts email from <itunes:email>[email protected]</itunes:email>.
4. System sends a code to [email protected].

The Bug

The system failed to fingerprint the content of the podcast to check for duplicates. It trusted any RSS feed as long as the email inside matched the submitter’s account.

This means if I download a famous podcast’s RSS feed, change the email inside it to my email, and host it on a public cloud storage, the system treats it as a new, valid podcast owned by me.