From User Enumeration to PII Exposure: Chaining Two APIs Into a $2,000 Bug

Summary

Member-only story From User Enumeration to PII Exposure: Chaining Two APIs Into a $2, 000 B ug F ree A r t i c l e L ink : [Cl i c k f or f ree!] (h ttp s : // m e d i u m . co m /@ e h t es ham u l ha q 198/ f ro m - u ser - e n u m er a t i o n - t o - p ii - e x p os u re - c hainin g - tw o - a p i s - in t o - a - 2 - 000 - b ug - a d b 9 e d 54 ab 30 ? s k = e 894290830 a 0 b 49 d a 7 e b 558 a f 5 f 35 c 89) O n eo f t h e bi gg es t mi s t ak es d e v e l o p ers mak e i s t hinkin g t ha t i f tw o A P I e n d p o in t s a re in d i v i d u a ll y ha r m l ess, u s in g t h e m t o g e t h er w i ll a l so b e ha r m l ess . U n f or t u na t e l y, t ha t i s n ’ t a lw a ys t r u e . D u r in g o n eo f m yrece n t sec u r i t y a ssess m e n t so n t a r g e t . co m, I c am e a cross w ha t ini t ia ll y l oo k e d l ik e a s im pl e u serse a rc h f e a t u re in s i d e t h eco m p an y ’ s A c a d e m y pl a t f or m . A t f i rs t g l an ce, t h ere w a s n ’ t an y t hin g p a r t i c u l a r l ye x c i t in g ab o u t i t . I t b e ha v e d e x a c tl y a s I e x p ec t e d am ess a g in g f e a t u re t o b e ha v e . O rso I t h o ug h t . A s I s p e n t m ore t im e u n d ers t an d in g h o wt h e a ppl i c a t i o n w or k e d, t ha t see min g l y ha r m l ess f e a t u re t u r n e d in t o a c hain e d B ro k e n A ccess C o n t ro l vu l n er abi l i t y t ha t a ll o w e d a l o w - p r i v i l e g e d u ser t oe n u m er a t e pl a t f or m u sers an d e x p osese n s i t i v e p erso na l in f or ma t i o na t sc a l e . T hi se v e n t u a ll yres u lt e d ina$ 2,000 bounty, but more importantly, it reminded me why understanding how APIs interact is often more valuable than looking at them individually. Looking Beyond the First Request When I’m testing an application, I rarely stop after finding a single interesting response.

By Ehtesham Ul Haq

Original Article

Fast Feed

From User Enumeration to PII Exposure: Chaining Two APIs Into a $2,000 Bug

Summary

By Ehtesham Ul Haq