Summary

@prateek_0490 was able to delete and deactivate special menu of any restaurant using IDOR

Going through the JS, I found another cool function which looked interesting and vulnerable and indeed it was vulnerable -

{var a={request_type:"deactivate-special-menu",user_id:USER_ID,menu_set_id:e};$.post("XXX/XXXXXX)"

It asked for a lot of information, and it required a lots of research/recon to actually achieve this but since after getting a feel for couple of weeks on Zomato's application I found a way to break this feature, I was able to delete/deactivate any/all special menus of any restaurant doesn't matter if I owned that restaurant or not.

I did try out to find a way to figure out the menu_set_id and moreover since I didn't wanted to test on any of @zomato's production users/customers/clients, I also had to find one of the test restaurants owned by Zomato on which I can replicate this, however during testing it was indeed found that there are lot's and lot's of restaurants who have these special menus, this would have lead to delete/deactivate all of them in One Go. I went ahead and deactivated a Special Menu of @zomato's internal testing restaurant_id XXXXXX with menu_set_id":XXXX which was active till 24th September. I apologised for the same to the team :(

POC

• An attacker first needs to figure out these information like user_id, menu_set_id before deactivating any menus. For that we can issue a Post Request with correct var at

Request

POST /XX/XXXXX?res_id=XXXXX HTTP/1.1
Host: api.zomato.com
X-Device-Is-Rooted: 0
Cookie: <COOKIES>
Content-Type: application/x-www-form-urlencoded

access_token=<your token>&client_id=zomato_ios_v2

• Since there was no restriction or a check to see if we actually hold that restaurant it leaked lots and lot's of useful stuff which was then chained with deleting the special menus of any restaurants.

• Now using all this information, an attacker makes a Post Request at -

Request

XXX/XXXXX.php

with var as user_id=XXXX&type=SPECIAL&request_type=get-special-menus&res_id=XXXXX

this gave some more useful information.

• Now the final request was made by changing the request_type in the Post Parameters, since I obtained the menu_set_id in our above requests, I made a final request to deactivate/delete that from the restaurants.

In case you have any questions, please feel free to reach me on [Twitter] (https://twitter.com/prateek_0490). :)

Best Regards, Prateek Tiwari