Changing One Customer ID Exposed Other Users’ Pet Recommendations and Earned Me a $1,000 Bounty

Description and use

Altering a single customer ID exposed other users’ pet recommendations, earning a $1,000 bounty.

Problem

A single customer ID change in the pet recommendation system leaked personalized recommendations of other users.

Outcome

The vulnerability allowed unauthorized access to personalized pet recommendations, resulting in a $1,000 bounty.

Workflow

• 1. Identify the endpoint that returns pet recommendations based on customer ID.
• 2. Observe that the endpoint accepts a customer ID as a query parameter without authentication checks.
• 3. Change the customer ID value to that of another user.
• 4. Retrieve and record the exposed pet recommendations.
• 5. Report the vulnerability to the bug bounty program and receive a $1,000 reward.

Evidence

Changing One Customer ID Exposed Other Users’ Pet Recommendations and Earned Me a $1,000 Bounty

Source

The vulnerability allowed an attacker to modify the customer ID in the request and view another user’s pet recommendations.

Source