id: intercom-identity-misconfiguration

info:
  name: Intercom Identity Verification Misconfiguration
  author: domwhewell-sage
  severity: medium
  description: |
    Identity Verification is not setup on the Intercom widget, allowing an attacker to impersonate a user and access their chat history.
  reference:
    - https://medium.com/@hellother18/uncovering-a-vulnerability-in-intercom-widget-chat-configuration-e5633d06df60
    - https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile
  tags: intercom,unauth,exposure,misconfig

variables:
  user_email: "test@example.com"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    max-redirects: 3

    matchers:
      - type: word
        words:
          - "app_id:"
        internal: true

    extractors:
      - type: regex
        name: intercom_app_id
        part: body
        group: 1
        regex:
          - 'app_id:\s*"([a-zA-Z0-9\-]+)"'
        internal: true

  - method: POST
    path:
      - "https://api-iam.intercom.io/messenger/web/ping"

    body: |
      app_id={{intercom_app_id}}&user_data={"email":"{{user_email}}"}

    matchers:
      - type: status
        status:
          - 200

    extractors:
      - type: dsl
        dsl:
          - Input
# digest: 4a0a00473045022028190efeb0390c4eccce2954ac93fda17c5654dce6d0af237bdf7289eb58d178022100caefb1b838e7b59252c17494f76806f25b78a218a5913940996f82c8a394f925:922c64590222798bb761d5b6d8e72950