Eternal · Report #1523584
Attacker shall recieve order updates on whatsapp for users who have activated whatsapp notification
Summary
Researcher was able to determine a scenario where it was possible for an attacker to view limited order status updates for orders that meet certain prerequisites.
Prerequisites for this scenario were following:
- WhatsApp status order updates should have been enabled first for the order from the primary number of the user.
- Order should not have been in the terminal state (not completed/cancelled).
Limited Status updates were shown till the order was moved to a terminal state (cancelled/completed). Moreover, past events that were already published were not pushed again.
Apart from the order status updates (picked up, on the way, delivered),
- It was not possible to view/extract any other information including user details
- It was not possible to alter/update/cancel order
Root cause of this was due to missing early exit of the validation layer and caching overwrite on the flow that handled subscription request.
Thanks to @schutzx0r for responsibly disclosing this issue to us.
How it was found
H
Summary:
- Order ID are IDOR ( Insecure Direct Object Reference )
- When users activated whats app notification an attacker would start receiving the notification without user interaction about their order.
Proof Of Concept:-
When an user order on a restaurant he/she can start whatsapp notification on their order.
██████████
Steps to Reproduce:-
-
When the user activates whats app notification by sending the message with order id. His order notification's vulnerable.
-
Now the attacker sends the message with above vulnerable order id ( Order id is IDOR - eg:15625383 )
-
He will get the error notification, though he will start receiving the updates.
{F1670097}
3.1 the updates would be 3.1.1 delivery partner assigned. 3.1.2 when he will reach 3.1.2 once he delivered the order.
Impact
business logic error.