Inadequate Access Control in Hiperdino REST API

Executive Summary

This vulnerability is an inadequate access control flaw in Hiperdino's REST API v1.0. The public endpoint 'customer/check' allows an authenticated attacker to input a telephone number or email address. If the input matches a registered customer, the API returns their contact details (email and phone number). Exploitation requires only a static bearer token without additional authentication, rate limiting, or proper error handling.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the 'customer/check' endpoint in Hiperdino's REST API v1.0. Look for repeated queries with static bearer tokens and responses containing user contact details without proper authentication. Use tools like Wireshark or tcpdump to capture API traffic and analyze patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow a remote attacker to enumerate a user's contact details by exploiting the 'customer/check' endpoint. Successful exploitation requires obtaining a valid static bearer token, which would enable the attacker to retrieve email addresses and telephone numbers associated with registered customers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations due to unauthorized access and disclosure of personal data (email addresses and phone numbers). It could lead to non-compliance with data protection requirements, resulting in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately revoke the static bearer token used for the 'customer/check' endpoint. Implement proper authentication mechanisms, rate limiting, and error handling. Restrict access to the endpoint and apply input validation to prevent enumeration attempts. Monitor for suspicious activity and update the API to enforce stricter access controls.

Useful 0 Not Useful 0