Vulnerability Summary
A hardcoded backend URL found in a JavaScript bundle exposed an unauthenticated API endpoint that returned 500+ records containing employee full names, enterprise client details, and internal database IDs. The writeup walks through discovering the URL in the JS bundle, querying the API, and the GDPR/business intelligence impact.
While reviewing the frontend JavaScript bundle of a demo/showroom web application belonging to a major telecom provider, I discovered a hardcoded backend API URL pointing to an Azure-hosted service. The backend exposed a session history endpoint that required zero authentication — no Bearer token, no cookies, no API key.
A single unauthenticated GET request returned 500+ records containing:
hackerone-reportsHackerOne disclosed report --> https://hackerone.com/reports/3443563 by somerandomdev
pyus3rThis writeup details an Information Disclosure (CWE-200) vulnerability that allowed viewing the source code and complete domain model mapping of a corporate backend.
pyus3rAn unprotected endpoint allowed the exfiltration, via a simple unauthenticated POST request, of gigabytes of configurations, structural metadata, and private personal/corporate information belonging to the organizations using the software.
No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In