Vulnerability Summary
HackerOne disclosed report --> https://hackerone.com/reports/3467641 by perxibes
While testing the application at fizzy.do domain asset into https://app.fizzy.do/ subdomain file uploads, I noticed that files and file previews served through Active Storage can be accessed directly via their URLs, without any authentication or authorization checks. These URLs remain accessible to other users and even to unauthenticated visitors, which allows access to private attachments outside the intended application flow.
heroxo9868Missing authorization checks allow unauthorized users to remove staff members from accounts they do not own, leading to potential disruption and abuse.
misesop375During a recent engagement on a food industry B2B platform, I discovered a vulnerability chain that allowed me to dump the entire database of users registered for a corporate event. By chaining a sequential ID enumeration vulnerability with a secondary IDOR on the “Edit Profile” endpoint - and optimizing the attack by identifying a weakness in the ID generation logic - I was able to access the Personally Identifiable Information (PII) of all event attendees.
pyus3rAn Insecure Direct Object Reference (IDOR) vulnerability in the organization API allows authenticated users to manipulate the identifier parameter and retrieve plaintext SFTP credentials belonging to other users or organizations, potentially leading to unauthorized access to sensitive files stored on the SFTP server.
No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In