Information Disclosure (CWE-200)CVSS 5.3€50
Information Disclosure — Unauthenticated API Exposes PII of 500+ Employees and Enterprise Clients
A hardcoded backend URL found in a JavaScript bundle exposed an unauthenticated API endpoint that returned 500+ records containing employee full names, enterprise client details, and internal database IDs. The writeup walks through discovering the URL in the JS bundle, querying the API, and the GDPR/business intelligence impact.
Summary
While reviewing the frontend JavaScript bundle of a demo/showroom web application belonging to a major telecom provider, I discovered a hardcoded backend API URL pointing to an Azure-hosted service. The backend exposed a session history endpoint that required zero authentication — no Bearer token, no cookies, no API key.
A single unauthenticated GET request returned 500+ records containing:
- Full names of employees
- Enterprise client company names and websites (major banks, insurers, tech companies)
- Session metadata: timestamps, demo types, session UUIDs
- Internal MongoDB ObjectIDs