Starbucks · Report #762251
Singapore - XXE at https://www.starbucks.com.sg/RestApi/soap11
Validstatus
highseverity
32upvotes
22 Jul 2020disclosed
Summary
rugb discovered the endpoint at https://www.starbucks.com.sg/RestApi/* was found vulnerable to XML eXternal Entity (XXE) processing. This permitted arbitrary reading of files on the remote server. This asset is not rated as critical as it does not contain sensitive data.
@rugb — thank you for reporting this vulnerability and for confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.