Search This Blog

Showing posts with label Insecure direct object reference. Show all posts

Zomato fixed a Security bug that allowed hackers to access Personal data of 62 Million users

Zomato, an online restaurant search and discovery service providing information on home delivery, dining-out, cafés and nightlife to various cities across India and 21 other countries, has fixed a bug which could allow an attacker to gain access to personal information of million users.

Anand Prakash, discovered Insecure Direct Object Reference(IDOR) vulnerability in the Zomato website.

IDOR occurs when an application provides direct access to objects based on user-supplied input. The vulnerability allows the attackers to bypass authorization and access resources in the system directly by modifying the value of a parameter used to directly point to an object, for example database records or files.

One of the API calls used for retrieving the users information is insecurely coded.  It gets the information only based on the "browser_id" parameter passed in a HTTP GET request and fails to verify the user is authorized to access the requested data.

By sequentially changing the 'browser_id' value, an attacker is able to access the users' personal information, such as Names, Email addresses, phone numbers, Date of birth.

"The data leaked also had Instagram access token which could be used to see private photos on Instagram of respective Zomato users,” Prakash wrote in his blog.

Prakash reported the vulnerability to Deepinder Goyal, CEO of Zomato, On June 1. And the next day (June 2), the flaw was fixed by Gunjan Patidar along with his engineering team.

You can also check the Proof of concept Video:

Privacy bug found in allows hackers to access your details

A Privacy bug was found in the largest Indian online music streaming service Gaana website, which allowed access to private details of users including the date of birth.

A Security researcher Avinash, found an Insecure direct object reference vulnerability, and reported it to the fixed the bugs after three weeks.

Avinash said a bug in an Internal API gave him access to 11 Million records.  A simple HTTP Get request with the corresponding User ID is enough to get their details.

The researcher said he was able to access full name, profile picture, email address, date of birth and last song they listened on Gaana. 

In his blog post, he wrote “ On 12th of May I had discovered a vulnerability on I contacted their team and it was fixed recently.”

When EHN contacted the author about why the original article has been removed from the blog by the author. He replied that "he removed it after getting a request from"

You can find the cached version of the Blog post in Google Cache