Torben: /* Conclusion */

2024-07-18T13:40:05Z

Conclusion

New page

==My first reported data leak in July 2024==

===Background===
After donating some money to a charitable project via their website, I became curious about how they populated their footer banner displaying recent donations.

===Findings===
Using the browser internal developer tools, I quickly discovered the raw data in JSON format, sourced from an unprotected public API. To my surprise, the raw data:
* included all (several thousand) donors, not just the recent ones.
* contained the last names of donors, while the website banner only displayed first names.
* revealed full names even for donors who had selected the "anonymous donation" checkbox, which resulted in just a flag in the JSON file.

===Assumptions===
I inferred that they:
* Calculated the total sum of donations on the frontend, thus providing the complete list of donations to the user's browser.
* Were unaware that all data provided to the frontend is visible to the user.
* Did not implement the "need to know" principle.

===Contact===
I sent an email with the subject "Data Leak," including screenshots (only of my own data, of course) and a link to their public API. This resulted in a very quick and thankful response.

===Responses===
Their first attempt to fix the issues was to apply some authentication mechanism to the public API. However, this was useless, since it remained transparent to the browser and its developer tools.

After pointing this out, I proposed the following fixes:
* Calculate the sum of all donations on the backend.
* Remove all unnecessary data from the JSON, especially last names.
* Limit the JSON to just the latest 100 donations.
* For anonymous donations, do not provide even the first name.
These suggestions were all implemented very quickly.

===Conclusion===
* A good deed done feels good.
* Fast and very thankful communication.
* Quick solution time, once I had offered a proposal
* Evidently poor IT sec basics on their implementation side.
* As reward, they offered me an ice cream, in case I happen to be near the office ;-)

Report Data Leak - Revision history

Torben: /* Conclusion */