HexBrain

Starbucks · Report #423286

Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busy

Validstatus
mediumseverity
16upvotes
24 Oct 2018disclosed

How it was found

Summary: I found the following URL, which appears to be running an Sidekiq web UI instance that is accessible unauthenticated: https://gift-test.starbucks.co.jp/sidekiq/busy

Description: Sidekiq is used for Ruby background processing (as I've learned, I'm not really familiar with it). The web UI can be used to stop these processes, as can be seen here:

{F359897}

Steps To Reproduce:

  1. Go to https://gift-test.starbucks.co.jp/sidekiq/busy

Supporting Material/References:

n.a.

Impact

Unclear. As the domain name suggests it might be a staging/test environment. I cannot determine clearly what these running processes are, but I am able to stop them which might be undesired.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original