Unauthenticated IDOR in Invoice PDF Export Exposes Any Customer’s Billing Document via Enumerable Booking ID
An invoice-export API accepted any non-empty token value and returned a public PDF URL for an arbitrary enumerable booking identifier. Because the API did not bind the caller to the requested booking, an unauthenticated attacker could enumerate booking IDs and retrieve customers’ invoice PDFs containing names, billing addresses, itineraries, and amounts paid.
Vulnerability: Insecure Direct Object Reference / Authorization Bypass Through User-Controlled Key (CWE-639) · Severity: High — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5; network-exploitable, no privileges or user interaction required, and results in high confidentiality impact through bulk invoice disclosure.
Summary
The invoice PDF export endpoint returned a storage URL for an invoice PDF based solely on a caller-supplied enumerable booking identifier.
The affected endpoint accepted requests in the following form:
GET /payments/v1/invoice-documents/?bookingId=<int> HTTP/1.1