Sensitive Data Exposure via JSON-RPC (Whistleblowing Channel)
An unprotected endpoint allowed the exfiltration, via a simple unauthenticated POST request, of gigabytes of configurations, structural metadata, and private personal/corporate information belonging to the organizations using the software.
Censorship Note: All data (domains, paths, URIs, JSON-RPC methods, variable names, corporate Tax IDs, emails, and company names) have been strictly anonymized using entirely fictional nomenclature (e.g.,
dashboard.internal-sec.com). This report is a simulated environment to guarantee 100% privacy for the affected program.
This writeup details a critical Information Disclosure vulnerability within a corporate Whistleblowing management platform.
An unprotected endpoint allowed the exfiltration, via a simple unauthenticated POST request, of gigabytes of configurations, structural metadata, and private personal/corporate information belonging to the organizations using the software.
Vulnerability Analysis
The flaw centered on a server-side JSON-RPC service that fed the graphical interface. Its actual intended purpose was to list the different available configuration "categories" through this endpoint:
