Instacart is an American company that operates as a same-day grocery delivery service. Customers select groceries through a web application from various retailers and delivered by a personal shopper. As of 2017, Instacart only has operations and services in the United States. [1]
Instacart has a bug bounty program on Hackerone, you can learn more about it at https://hackerone.com/instacart. I’ve reported multiple valid security issues(ranked #3, https://hackerone.com/instacart/thanks ).
Instacart has a hiring section for shoppers https://shoppers.instacart.com/, where a potential candidate can enter his details and set up a meeting.
The Auth part was of this section was had an interesting bug.
One day I received an email which said “set up your meeting”, I clicked the linked and it logged me in without asking any credentials.
After breaking down the Auth link, found out it was GET request with pin code, phone number, and a verification code which was in the format
https://shoppers.instacart.com/applicant_login?code=PINCODE+MOBILE+CODE
The login process from the ‘sign-in’ page required an OTP sent to the registered mobile. Tried to log in multiple times from the login page, surprising part was getting the same OTP every time.
In order to show the impact, the attack must be applicable to all accounts.
Obviously, the first attempt will be brute forcing the login form with known mobile number and as the verification code consists 5 digits. We can start from 00000 to 99999 but that didn’t work and I got blocked by the rate limit after certain attempts.
As it was a GET request, one can brute force the URL itself. Just brute force the code part for a known number in the URL
https://shoppers.instacart.com/applicant_login?code=PINCODE+MOBILE+CODE
And it worked!
Though the whole attack depends upon a known pin code and mobile number, Instacart accepted the report as medium severity and paid their highest bounty of that time.
Later, Instacart replaces the auth part with Twitter fabric.
Thanks for reading. If you have any suggestions or feedback, feel free to reach out on Twitter
Manish 🙂
Reference:
what I'm breaking... 