My open-source experience

Описание и применение

Автор обнаружил уязвимость авторизации в проекте BookCars, где поставщик может изменить статус бронирования другого поставщика, и задокументировал её, подчеркнув необходимость тщательного анализа перед сообщением.

Задача

A supplier could change another supplier's booking status in BookCars because the updateStatus() endpoint does not verify booking ownership.

Результат

The author discovered an authorization flaw in BookCars, documented it, and reflected on the importance of thorough investigation before reporting.

Рабочий процесс

• 1. Reviewed the updateStatus() endpoint and its authentication middleware. 2. Compared it with deleteBookings() to find missing ownership check. 3. Used AI to guide code exploration but verified findings manually. 4. Created a GitHub issue documenting the vulnerability.
• 5. Planned to add a minimal reproduction or regression test in future work.

Доказательства

I focused on the updateStatus() endpoint, where a supplier can update booking statuses after passing authentication and the supplier-role check. While tracing the code, I noticed that the endpoint looks up bookings only by their IDs and does not verify that the booking actually belongs to the supplier making the request

Источник

I used AI mainly as a second pair of eyes for code exploration and reasoning, rather than treating its answers as proof.

Источник