Loading HuntDB...

Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busy

Medium
S
Starbucks
Submitted None
Reported by jackds

Vulnerability Details

Technical details and impact analysis

Improper Access Control - Generic
**Summary:** I found the following URL, which appears to be running an Sidekiq web UI instance that is accessible unauthenticated: https://gift-test.starbucks.co.jp/sidekiq/busy **Description:** Sidekiq is used for Ruby background processing (as I've learned, I'm not really familiar with it). The web UI can be used to stop these processes, as can be seen here: {F359897} ## Steps To Reproduce: 1. Go to https://gift-test.starbucks.co.jp/sidekiq/busy ## Supporting Material/References: n.a. ## Impact Unclear. As the domain name suggests it might be a staging/test environment. I cannot determine clearly what these running processes are, but I am able to stop them which might be undesired.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Access Control - Generic