Shopify · Report #97535

List of devices is accessible regardless of the account limitations

Validstatus

$500bounty

3upvotes

10 Nov 2015disclosed

Summary

The /admin/mobile_devices.json endpoint could disclose the SNS tokens for each connected mobile device. While this token would not be useful for an attacker on its own, we have removed the endpoint since it was no longer useful.

How it was found

List of devices is accessible regardless of the account limitations.

PoC

. Create a limited account A with no rights. . Log some devices with a different account B. . From account A, GET /admin/mobile_devices.json. . List of devices.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original