Authorization Bypass in SplitPro Allows Unauthorized Expense Access

Executive Summary

This vulnerability is an authorization bypass in SplitPro through version 2.1.6. Authenticated users can read other users' expenses by providing arbitrary expenseId values to the expense.getExpenseDetails endpoint. Attackers with access to an expense UUID, such as former participants, can retrieve sensitive details like expense notes, recurrence schedules, and participant information.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect API requests to the expense.getExpenseDetails endpoint. Check if arbitrary expenseId values return sensitive data without proper authorization. Use tools like curl to test: curl -X POST -H 'Content-Type: application/json' -d '{"expenseId":"arbitrary-uuid"}' http://your-server/api/trpc/expense.getExpenseDetails. Monitor for unauthorized data exposure in logs.

Useful 0 Not Useful 0

Impact Analysis

If you use SplitPro up to version 2.1.6, an attacker with your expense UUID could access your expense details, notes, and participant information. This could lead to privacy breaches, data leaks, or misuse of your financial data. Former participants or group members with old access could still retrieve this data even after removal.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR by exposing personal and financial data without proper authorization. It may also conflict with HIPAA if health-related expense data is involved, as unauthorized access to sensitive information could lead to compliance violations and legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SplitPro to the latest version beyond 2.1.6. Implement strict input validation for expenseId in the expense.getExpenseDetails endpoint. Ensure the endpoint verifies the caller's participation in the expense before disclosing data. Restrict access to the endpoint via network policies if possible.

Useful 0 Not Useful 0