FirstBlood-#699 — All vaccination proof records leaked
This issue was discovered on FirstBlood v2

On 2021-10-27, buraaq Level 2 reported:

Hello zseano,

Summary

File /vaccination-manager/swagger.yaml can be reached easily by directory brute-forcing. It gets downloaded. Contains the info about another endpoint which gives out the info about Full details for all vaccination proof records which should not be available publicly.

It contains :
ID
Email
Proof
IP of victim
User-Agent
Creation time
Steps to reproduce
  1. Visit the endpoint /vaccination-manager/swagger.yaml
  2. Open swagger.yaml file. Goto the endpoint mentioned in file /vaccination-manager/api/vax-proof-list.php
  3. You can see all the record details for all vaccination proof records.
POC

Impact

Sensitive data is accessible publicly

Kind regards,

buraaqsec

P1 CRITICAL

Endpoint: /vaccination-manager/vax-proof-list.php

This report contains multiple vulnerabilities:

  • Info leak
  • Information leak/disclosure

FirstBlood ID: 37
Vulnerability Type: Information leak/disclosure

The endpoint /vaccination-manager/api/vax-proof-list.php leaks PII without any authentication. The intended solution was to find it via swagger-ui at /vaccination-manager/api.php

FirstBlood ID: 31
Vulnerability Type: Information leak/disclosure

The endpoint api.php can be found under the vaccination manage portal directory which allows for user interaction and results in PII leak on vax-proof-list.php