FirstBlood-#281Hackerback Event Details Along with Attendee's Personal Information Exposed to Public



On 2021-05-15, netmous3 reported:

Description:

Current and previous hackerback event information's along with the attendee's personal information was exposed to the public. The vulnerable endpoint did not employ any of the authentication mechanisms before releasing that information.

Steps To Reproduce:
  1. Create a GET request to the vulnerable endpoint while adding an extra header value as below.
    X-SITE-REQ: permitted
  2. Observe the hackerback event details in the response.
  3. Use both event id values (560700 and 560720) with query parameters to retrieve both old and current event details.
Impact:

The company could face a financial losses and credibility losses due to a patient's PII leak.
Further, there could be lawsuits against the company issued by the victims of data leak. Requests for damages, if the institution’s irresponsibility for information security is proven, will not only cause financial losses and irreversible corporate reputation, but will also mark the business in court.

P1 CRITICAL

Endpoint: /attendees/event.php?

Parameter: q

Payload: 560700 and 560720


FirstBlood ID: 13
Vulnerability Type: Info leak

/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.


Respect Earnt: 1000000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.