Grab · Report #221558
Private Grab Messages on Android App can be accessed and cached by Search Engines
Summary
This issue can be classified as best-practice. The exploitation against other users was very unlikely (possible under rare circumstances), but the team still decided to award me with a bounty - i very appreciate it! The team was very responsible and fixed the issue fast.
I requested to disclose this report to show the impact from search indexing of privileged/sensitive info. The reported issue itself is not very interesting, and not impactful much, but the idea behind it can help the other researchers to find more interesting bugs:) The applications can leak to the Search Engines emails (check it using allinurl:@<mailbox_domain> site:<target_domain>), sensitive tokens (same dork, but with 3-4 entropy characters depending on discovered info upon testing), private info of other users, etc.
Many interesting things and issues can be found just by using Google/Shodan/Censys etc.
How it was found
Description
Hello. Today i discovered, that Search Engines can access the private users messages (OTP pins, Group invites information etc.)
It happens because the https://grab-attention.grabtaxi.com host allows search indexing, and can leak the auth_token to the Search Engines which also can lead to privilege escalation.
When vieving "Notifications" section on the app, i noticed the unsecure GET request to the https://grab-attention.grabtaxi.com/passenger/passenger.html?auth_token=[my_token]&view=268435456. I was surprised, when tried to repeat it in the browser - it gave me access to my messages.
POC
{F176465} {F176466}
Steps To Reproduce:
- Cheking the private messages of other user (me): https://grab-attention.grabtaxi.com/passenger/passenger.html?auth_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJQQVNTRU5HRVIiLCJleHAiOjQ2NDUyMzk1NDUsImlhdCI6MTQ5MTYzOTU0NSwianRpIjoiZWI0YmFiMjUtYzA2Yi00MGIzLWJiZTctMzZkYzFmMWRkZTMyIiwibG1lIjoiU1lTVEVNIiwibmFtZSI6IiIsInN1YiI6IjM2NWE0NjY0LTY1MGEtNDBjZC05YWU2LTQ4YWQwN2Q2NGY2OSJ9.eTX2dWnooTxm50Dv1VYoIZanOqCe073_AmVk97VE4p7m4e26mcWtnZzQz5IR1EwuWbs52qJLzzAIZ5KcpWoKCvadu6zuRQzy2xRk8BcFDUXGl8w8doPJbuSIHMY0K-x8Q-█████████ZTdgxLI&view=268435456#/
- Checking that search engines can crawl it:
Use this Google DORK (search text):
passenger site:grab-attention.grabtaxi.comand press Search. You will see this cached page with auth_token (actually it was cutted due to big query length) - but it is still a huge information disclosure.
Suggested fix
- Disable Search indexing on
https://grab-attention.grabtaxi.com - For the better security you can change the request method to the
https://grab-attention.grabtaxi.com/passenger/passenger.htmlendpoint from GET to POST (or encrypt it) due to that fact that auth_token are leaked in the query parameters.