Thursday, 4 June 2015

[Responsible disclosure] How I hacked 62.5 million Zomato Users


Note: This is being published with the permission of Zomato Team. The vulnerability is now fixed. 

Zomato is an online restaurant search and discovery service providing information on home delivery, dining-out, cafés and nightlife for various cities of India and 21 other countries. It has 62.5 million registered users.
While creating an account, a user can store his phone number, addresses, date of birth, link Instagram account etc. In one of the API call, they were reflecting the user data based on the "browser_id" parameter in the API request. Interestingly, changing the "browser_id" sequentially resulted in data leakage of other Zomato users. The data leaked also had Instagram access token which could be used to see private photos on Instagram of respective Zomato users.

Below are the technical details of the vulnerability:

Description:

Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization and access resources in the system directly, for example database records or files. 
Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user supplied input and uses it to retrieve an object without performing sufficient authorization checks.

Vulnerable endpoint:

POST /v2/userdetails.json/XXXXX?&browser_id=XXXXX&type=journey&lang=en&uuid=pgh1evyBWvL+sp9/JpwUpItnk8Q=&app_version=6.5.0.1 HTTP/1.1
Accept: */*
Content-Length: 214
Accept-Encoding: gzip, deflate
X-Zomato-API-Key: XXXXXXX
Content-Type: application/x-www-form-urlencoded
User-Agent: Zomato/5.0
Host: 1api.zomato.com
Connection: Keep-Alive
Cache-Control: no-cache

lang=en&uuid=pgh1evyBWvL%2Bsp9%2FJpwUpItnk8Q%3D&client_id=Zomato_WindowsPhone8_v2&app_version=6.5.0.1&device_manufacturer=NOKIA&device_name=NOKIA%2520Lumia%25201020&access_token=xyz

Replacing the XXXXX with victim's user id in the above request led to information disclosure.

Ease of exploitability:

You can easily get userid of any zomato user by visting their profile. They are public and appended to your profile url.
Proof of concept video:



This bug was responsibly disclosed to Zomato and was fixed within few minutes by the engineering team.  

Disclosure Timeline:
June 1, 2015  09:29 PM : Report sent to Deepinder Goyal, CEO 
June 2, 2015  12:54 PM :  Added Gunjan Patidar, CTO and Shrey Sinha to the mail thread
June 2, 2015   1:04 PM  : Bug acknowledged by Gunjan Patidar 
June 2, 2015  2:01 PM   : Confirmation of vulnerability fix from Gunjan Patidar. 
 

50 comments :

  1. What they did to fix bug? If they just took API offline, then it's not fix within "few mins". :)

    ReplyDelete
    Replies
    1. HOW I GET A LOAN HELP @ 2% INTEREST RATE

      I was not sure of getting a legit loan lender online But when i could not face my Debt any more, my son was on hospital bed for surgery that involve huge money and i also needed some money to refinance and get a good home then i have to seeks for Assistance from friends and when there was no hope any more i decide to go online to seek a loan and i find VICTORIA LAWSON Trust Loan Firm (marianlawson@outlook.com) with 2% interest Rate and applied immediately with my details as directed. Within seven Days of my application She wired my loan amount with No hidden charges and i could take care of my son medical bills, Renew my rent bill and pay off my debt. I will advice every loan seeker to contact VICTORIA LAWSON LOAN Company with marianlawson@outlook.com For easy and safe transaction.

      *Full Name:_________

      *Address:_________

      *Tell:_________

      *loan amount:_________

      *Loan duration:_________

      *Country:_________

      *Purpose of loan:_________

      *Monthly Income:__________

      *Occupation__________

      *Next of kin:_________

      *Email :_________

      Delete
  2. This comment has been removed by the author.

    ReplyDelete
  3. Wow, no bounty? That's a great way to dissuade security researchers like yourself from finding vulnerabilities on their site. Never trusting them with my data.

    ReplyDelete
  4. Wow, no bounty? That's a great way to dissuade security researchers like yourself from finding vulnerabilities on their site. Never trusting them with my data.

    ReplyDelete
  5. zomato is cheap, not even offered bounty? shame on zomato.

    ReplyDelete
  6. kUDOS to people like you.

    ReplyDelete
  7. Hai, prakash can you please contact me on mail : hostweb13@gmail.com
    Please its very much urgent...

    ReplyDelete
  8. This is sort of unethical practice in a society which mislead people through web blog engineering assignment help and they share their personal data on that and later on it becomes harmful for the user about their privacy.

    ReplyDelete
  9. Vlad Bogdan is simply the best hacker I have come across. He helped me hack my ex boyfriends Facebook,whatsapp and emails in less than 48hours. He is a professional and also Clears license suspensions, monitors calls, hacks database,changes school grades, clear criminal records without any traces. You can contact him on his email Vladhackworld@gmail.com or his kik VladTech. Good luck

    ReplyDelete
  10. I hired distincthacker@gmail.com, to help me hack my ex husband’s bank account and steal money to mine. I don’t know how good he is with other hacks but he is 100% good at moving money between accounts, I made 25,000 USD after 9 days... he's also good and fast if you want to hack your husband/boyfriend/partner/spouse iphone, icloud, phone, text messages, whats app and also account details, he's great and he's helped me got alot of information i used in court during my divorced

    ReplyDelete
  11. HOW I GET A LOAN HELP @ 2% INTEREST RATE

    I was not sure of getting a legit loan lender online But when i could not face my Debt any more, my son was on hospital bed for surgery that involve huge money and i also needed some money to refinance and get a good home then i have to seeks for Assistance from friends and when there was no hope any more i decide to go online to seek a loan and i find VICTORIA LAWSON Trust Loan Firm (marianlawson@outlook.com) with 2% interest Rate and applied immediately with my details as directed. Within seven Days of my application She wired my loan amount with No hidden charges and i could take care of my son medical bills, Renew my rent bill and pay off my debt. I will advice every loan seeker to contact VICTORIA LAWSON LOAN Company with marianlawson@outlook.com For easy and safe transaction.

    *Full Name:_________

    *Address:_________

    *Tell:_________

    *loan amount:_________

    *Loan duration:_________

    *Country:_________

    *Purpose of loan:_________

    *Monthly Income:__________

    *Occupation__________

    *Next of kin:_________

    *Email :_________

    ReplyDelete
  12. I basically think we all don't have to all these deceit and lies from our spouse...in a case of mine wen i got sick and tired of all the lies and deceit i had to contact a friend of mine to get me the contact of one of the best hackers in the states ..then i met cyberphonehacker@gmail.com..He saved me from the lies of my cheating boyfriend by hacking his phone.. In case you need help with hacking any phone or account or other jobs..Tell him i referred you.He will help you

    ReplyDelete
  13. i was lost with no hope for my wife was cheating and had always got away with it because i did not know how or always too scared to pin anything on her. with the help a friend who recommended me to cyberhackanswers@gmail.com who help hack her phone, email, chat, sms and expose her for a cheater she is. I just want to say a big thank you to cyberhackanswers@gmail.com . am sure someone out there is looking for how to solve his relationship problems, you can also contact him for all sorts of hacking job..he is fast and reliable..tell him james kors reffered you..he would be willing to help

    ReplyDelete
  14. I Basically think we all don't have to face all these deceit and lies from our spouse...in a case of mine wen i got sick and tired of all the lies and deceit i had to contact a friend of mine to get me the contact of one of the best hackers in the states ..then i met cyberhacksolutions@gmail.com..He saved me from the lies of my cheating husband by hacking his phone..Incase you need help with hacking any phone or account or other jobs contact him via email/phone (CYBERHACKSOLUTIONS@GMAIL.COM) or +1 916 378 4978 Tell him i reffered you.He will help you

    ReplyDelete
  15. HOW I GOT MY LOAN FROM THIS GREAT COMPANY

    Hello my dear people , I am Anita Frank, currently living in New jersey city, USA. I am a widow at the moment with three kids and i was stuck in a financial situation in April 2015 and i needed to refinance and pay my bills. I tried seeking loans from various loan firms both private and corporate but never with success, and most banks declined my credit ,do not full prey to those hoodlums at there that call them self money lender they are all scam , all they want is your money and you well not hear from them again they have done it to me twice before I met Mr. Wilson Edwards the most interesting part of it is that my loan was transfer to me within 74hours so I will advice you to contact Mr. Edwards if you are interested in getting loan and you are sure you can pay him back on time you can contact him via email……… (wilsonedwardsloancompany@gmail.com) No credit check, no co signer with just 2% interest rate and better repayment plans and schedule if you must contact any firm with reference to securing a loan without collateral then contact Mr. Wilson Edwards today for your loan
    They offer all kind of categories of loan they
    Short term loan (5_10years)
    Long term loan (20_40)
    Media term loan(10_20)
    They offer loan like
    Home loan............., Business loan........ Debt loan .......
    Student loan..........,Business start up loan
    Business loan....... , Company loan.............. etc
    Email..........(wilsonedwardsloancompany@gmail.com )
    When it comes to financial crisis and loan then Wilson Edwards loan financial is the place to go please just tell him I Mrs. Anita Frank direct you Good Luck.......................

    ReplyDelete
  16. Thanks for publishing this short article. It had been really informative. I will be sure to tell my friends and co workers about that blog and you'll get some more supporters. I read the post twice and I agree with every point you made. I will make sure to have a look at other pages on your site.

    ReplyDelete
  17. contact hackspiritman@gmail.com also feel free to call on +15125613294
    He's realiable, fast and cheap. Hack into any database, Bank account, paypal account, blogs, credit cards (clear your debts and drop money into your credit cards), smartphone hacks, professional hacking into institutional servers, keylogging, University grades changing, Admin(staff) account hack, Access/Password (facebook, instagram, bbm, Skype, snapchat, twitter, badoo, Word Press,zoosk, various blogs, icloud, apple accounts etc.)-clearing of criminal records -email accounts hack (gmail,yahoomail,hotmail ), breach of web host servers, Untraceable IP

    ReplyDelete
  18. i was lost with no hope for my wife was cheating and had always got away with it because i did not know how or always too scared to pin anything on her. with the help a friend who recommended me to cyberhackanswers@gmail.com who help hack her phone, email, chat, sms and expose her for a cheater she is. I just want to say a big thank you to cyberhackanswers@gmail.com . am sure someone out there is looking for how to solve his relationship problems, you can also contact him for all sorts of hacking job..he is fast and reliable..tell him james kors reffered you..he would be willing to help

    ReplyDelete
  19. i was frustrated and depressed when i noticed my spouse was cheating on me and there was nothing i could do about it, one day i saw an ad by this hacker and decided to contact him we got to talking and they have been helping me ever since; hacking into phones and intercepting text messages, getting mail passwords,registry hacks e.t.c. right now i am in the final stages of my divorce getting what i deserve all thanks to cyberhacklove. you should contact them if you have any hacking related cyberhacklove@gmail.com

    ReplyDelete
  20. I Basically think we all don't have to face all these deceit and lies from our spouse...in a case of mine wen i got sick and tired of all the lies and deceit i had to contact a friend of mine to get me the contact of one of the best hackers in the states ..then i met cyberhacksolutions@gmail.com..He saved me from the lies of my cheating husband by hacking his phone..Incase you need help with hacking any phone or account or other jobs contact him via email/text (CYBERHACKSOLUTIONS@GMAIL.COM) or text +1 916 378 4978 Tell him i reffered you.He will help you

    ReplyDelete
  21. If you need to hack into any database, delete record, improve credit score, spy on whatsapp, text, phone, emails, as long as it's hack contact cyberappshacker@gmail.com via Email :: cyberappshacker@gmail.com he is great, you won't be disappointed, cheap and fast, he saved my relationships

    ReplyDelete
  22. The technical associates at the antivirus website will be able to guide you as to what you can do to use your Gmail account properly while your antivirus is turned on.visit this site

    ReplyDelete
  23. I strongly recommend blackhatthacker@gmail.com, she helped me spy on my husband and served as a personal investigator to me by helping me spy on my husband's phone activities like facebook, email, whatsapp, calls, skype and others. I'm sure someone out there is looking for how to solve his relationship problems, just contact blackhatthacker@gmail.com and i'm sure he will help you too.

    ReplyDelete
  24. Information about Zomato an online restaurant search and discovery service provider is very nice. I hope it will help many of them to know about the services. There are several unfamiliar service providers around us. essay writing service reviews is one the essay writing service provider in uk and usa.

    ReplyDelete
  25. I can hardly imagine what it could be like. Such a custom writing service great amount of people. How did they deal with it?

    ReplyDelete
  26. Let’s keep are safe place to play the very best free games for kids! Please click:

    - slither.io
    - wings.io
    - vanar.io
    - Pokemon GO
    - diep.io
    to play for free!

    ReplyDelete
  27. As you said, Zomato is a platform to get information about home delivery, dining-out, cafés and nightlife for various cities of India and 21 other countries. You will also get more reviews like this from essay writing service reviews

    ReplyDelete
  28. Cybercracker07@gmail.com are professional hacking team base in canada. We have
    testimonies from our numerous clients around world. We are the best hackers
    Existing. We are specialise in hacking the following:
    * Hack and UPGRADE UNIVERSITY GRADES
    * Hack into any BANK WEBSITE
    * Hack into any COMPANY WEBSITE
    * Hack into any GOVERNMENT AGENCY WEBSITE
    * Hack into SECURITY AGENCY WEBSITE and ERASE CRIMINAL RECORDS
    * Hack into any DATA BASE
    * Hack PAYPAL ACCOUNT
    * Hack WORDPRESS Blogs
    * SERVER CRASHED hack
    * Untraceable Ip etc
    * We can restore LOST FILES AND DOCUMENTS , no matter how long they
    have been missing
    * Is your partner cheating on you, we can teach you how to TAP INTO THEIR CALL and monitor their conversation
    * Email and Text message interception
    * Extract and use Credit Card to shop online
    * Monitor any phone and email address
    * Hack Android & iPhone
    contact m cybercracker07@gmail.com

    ReplyDelete
  29. This hacker( hyperhacktive1@gmail.com ) help me discover my cheating boyfriend by hacking his PHONE,FACEBOOK AND WHATAPP i was very devastated that my 2 years relationship was all a BIG lie , but A BIG THANKS to this hacker that saved me from making the biggest mistake of my life, you can contact him , his JOB isone of a kind because i totally trust him, you can tell him you are from me sali

    CONTACT HIM:- hyperhacktive1@gmail.com

    ReplyDelete
  30. Contact cyberappshacker@gmail.com they helped me hack my fiancees phone and gmail i could not believe i was been played all along,i feel relieved now that i know the truth and now i can move on with my life, a professional indeed they are , you should contact them if you want to find out the truth and save yourself heart break and pain, you can contact the for any issue regarding hacking

    ReplyDelete
  31. My girlfriend is a big time cheat and I was able to confirm that through the help of secretrevealer04@gmail.com

    I contacted him to help me hack into my girlfriend social media (Facebook,call log,imessage.Gmail and also whatsapp)
    and discovered she was SLEEPING WITH her so called best friend, now I am happy and single and ready to move on thanks to
    secretrevealer04@gmail.com who did the hacking job for me.

    Contact him today and tell him kniffen referred you to him..He would be willing to help you

    Please you don't have be worried he is quick and fast and reliable cause they have been tested and trusted.

    ReplyDelete
  32. Hello everyone! I had seen so many recommendations on worldsuccesshacker@gmail.com, so I contacted him to help me spy on my wifes cell phone. He was really efficient and now I have access to everything including phone calls, and and I get to see all this from my phone without him knowing.
    Tell him Laura referred you for his services, he'd help.
    Contact: worldsuccesshacker@gmail.com

    ReplyDelete
  33. Hello everyone! If you require the service of a professional hacker to help track your partner's cell phone remotely, contact deadlyhacker01@gmail.com, he was helpful in helping me hack my husband's phone without physical contact.
    Tell him Stacey referred you.

    ReplyDelete
  34. Only the best essay writing service reviews can promise you top grade in best essays. There are several essay writing services that think they are top. Best service providers must have the features like plagiarised content, creative ideas and live chat facility with writers and customers.

    ReplyDelete
  35. Oh yeah! They are so adorable~~ Thank you for sharing!! Love these stuff very much >.< With these I think I will start drawing my own
    list of emoticons | wwwgooglesearch | facebook lite

    ReplyDelete
  36. You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
    mortal kombat x, a10.com, roblox games, color switch game

    ReplyDelete
  37. Ethicalhacking76@gmail.com is a professional hacker that specializes in exposing cheating spouse,and every other hacking related issues. he helps catch cheating spouse by hacking their communications like call, Facebook, text, emails, Skype and many more. i have used this service before and he did a very good job, he gave me every proof i needed to know that my fiancee was cheating. You can contact him on his email ethicalhacking76@gmail.com to help you catch your cheating spouse, or for any other hacking related problems, he will definitely help you, he has helped a lot of people, contact him and figure out your relationship status. i wish you the best too.

    ReplyDelete
  38. This hacker(hyperhacktive1@gmail.com) help me discover my cheating boyfriend by hacking his PHONE,FACEBOOK AND WHATAPP i was very devastated that my 2 years relationship was all a BIG lie , but A BIG THANKS to this hacker that saved me from making the biggest mistake of my life, you can contact him , his JOB isone of a kind because i totally trust him, you can tell him you are from me sali

    CONTACT HIM:- hyperhacktive1@gmail.com

    ReplyDelete
  39. Expert writer's reviews will help to choose best service provider.thesis writing service reviews have high qualified professional writers they offer trustworthy reviews about services after study it deeply.

    ReplyDelete
  40. I have been with a cheating spouse before and trust me I know how it feels, those suspicions are not mere paranoia. If you suspect that he is cheating, he definitely is..I hired a PI who helped me install monitoring bugs on his phone that diverted all his messages( facebook, whatsapp, text messages, and even phone calls) to my phone: (hackerethique gmail) is the man for the job with a very high level of professionalism and highly reliable. I really enjoyed working with him and the few friends I told have been nothing but thankful to me for the referral

    ReplyDelete
  41. If you need to hack into any database, delete record, improve credit score, spy on whatsapp, text, phone, emails, as long as it's hack contact darkghostz101@gmail.com via Email :: darkghostz101@gmail.com he is great, you won't be disappointed, cheap and fast, he saved my relationships

    ReplyDelete


  42. I have used darkghostz101@gmail.com quite a number of times and he has never disappointed me.He does all types of mobile hacks,get unrestricted and unnoticeable access to your partner/spouse, Facebook account,Email,Whatsapp.Text messages.Getting the job done is as simple as sending an email to darkghostz101@gmail.com stating what you..

    ReplyDelete

  43. This hacker(CYBERHACKSOLUTIONS@GMAIL.COM) help me discover my cheating boyfriend by hacking his PHONE,FACEBOOK AND WHATAPP i was very devastated that my 2 years relationship was all a BIG lie , but A BIG THANKS to this hacker that saved me from making the biggest mistake of my life, you can contact him , his JOB isone of a kind because i totally trust him, you can tell him you are from me suzan CONTACT HIM:-(CYBERHACKSOLUTIONS@GMAIL.COM) or text +1 916 378 4978

    ReplyDelete
  44. Look he's real I have confirmed it, contact hyperhacktive1@gmail.com for your hack issues ranging from bank hacks, University Grades change, Email and phone hack for text, whatsapp imessages, call logs,Gps tracking and lots more. He provides proof and he's affordable trust me he's real. His name is John a computer Engineer.

    ReplyDelete