Third-party hijacking and repair of meizu login website Authentication Service

The logon address of the meizu user (which is caused by the appuri or useruri Parameter not tested ):
Https://member.meizu.com/login.jsp? Appuri = RETURN_URL & useruri = RETURN_URL & service = uc
The same RETURN_URL does not undergo Domain Verification and can be returned to any website.
The returned address still contains tokens. If it is evil, we can obtain the token used by the target user to log on to the user center. The meizu user center seems to have another "my account", which contains (￥ _ $) ah
Return address: http: // RETURN_URL/login? Passive = true & useruri = USERURI & token = TOKEN
The method is also very easy to use. You can add a TOKEN file to the jump address and redirect it to the meizu website portal. (Do I Need To Find The token Authentication entry ?)
Directly go to the user center...
Proof of vulnerability: https://member.meizu.com/login.jsp? Appuri = RETURN_URL & useruri = RETURN_URL & service = uc
 
Replace RETURN_URL with the jump address
Solution: Perform domain verification on the redirected address.
If you can, contact me!
 
From Ambulong @ wooyun