HexBrain

Instacart · Report #168223

User Information sent to client through websockets

Informativestatus
1upvotes
7 Dec 2016disclosed

How it was found

I noticed when monitoring the websocket requests that the account information of user, including user_id is sent to the client.

{"t":"d","d":{"r":8,"a":"p","b":{"p":"/carts/3671079_xjdJHqx88J435eDW5zxN/users/-KRbGN8R6uIjy6_OPx_j","d":{"id":25390626,"name":"Username}}}}

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original