Exposed trip_no in WebSocket Responses Leading to Excessive information Disclosure
Medium
B
Bykea
Submitted None
Team Summary
Official summary from Bykea
@mrrhacker discovered a vulnerability in Bykea’s WebSocket implementation where trip_no was exposed to drivers before a bid was accepted. This identifier could be used to access customer tracking URLs, revealing excessive information of the customers to unauthorised drivers. The issue was resolved by masking sensitive identifiers in WebSocket responses and introducing hashing in tracking URLs to prevent unauthorised access.
Actions:
Reported by
mrrhacker
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Improper Access Control - Generic