Comment by OJFord | Hacker News Reader

Comment by OJFord | Hacker News Reader

Parent Full thread

I booked a hotel stay (in Canada, not Australia) and got an error page at some point that dumped out all env vars including database credentials.

Tried my best to report (not publicly disclose) it, including asking the front desk for contact information for IT; no response.

I think we're (on HN) often in quite a bubble of being (or striving to be) hot on this sort of thing, or frankly far trickier to exploit sorts of things, when really the bar for a lot of ('IT is a cost centre') stuff out there is extremely low.

I don't think this sort of leak or vulnerability is anywhere near as rare (which isn't even that rare) as it seems - I think an awful lot must just get quietly exploited or go unnoticed. We're only hearing about this one because someone thought it was 'lolz', I didn't publicize the one I noticed (in my normal user behaviour of just trying to book a room!) nor did I see if I could connect to the database and book myself in for free or something. And I only noticed it because it a) experienced an error; b) dumped env vars in the event of an error - i.e. I didn't have to look for it. How many other sites have I used since with similar problems but which just didn't happen to serve it up on a silver platter for me?

Leaks are everywhere. I went to a certain country and needed to register my phone, somehow ended up in a workflow that allowed me to enter any national registration number (similar to a social security number) and it would output the person's name, phone number, address and other details for me to confirm that that was me :)

No rate limiting on the endpoint, doesn't require auth, didn't block my VPN, doesn't even set cookies (very privacy conscious devs apparently). I could have mined the entire country's data. Insane.

How do you know it wasn’t rate limited?

for((i=0;i<=99999999999;i++));do curl https://site.com/info.php?id=$i > $i.json done

This is a tangent, but curl has built-in support for “globbing”. For numeric ranges you can just put the range in [brackets] and it handles the rest.

Hardly matters. If an endpoint is leaking anything as sensitive as national ID + name + address, a determined attacker will have no problem with scraping it slowly or using a network of proxies to avoid rate limits.

My favorite is just having the console open while visiting the web. It is amazing the amount of information devs "forget" to remove from sending to the console in production. A lot of console vomit is from JS frameworks. I don't know if there's a switch that can tell them to shut up in production or not, but it's one thing I look out for on anything I work on.

const log = function(thingToLog) { if (DEV_ENVIRONMENT) console.log(thingToLog) }

Most C-level people couldn't care less about security. I'm yet to work for a SaaS that implements 2FA, yet at some point all of them have had passwords that a script kiddie could brute force within an hour. The only time I've seen security become a top-level priority was when some customer demanded some kind of checkbox compliance like SOC / ISO27001.

You call it checkbox compliance, but it does at least make vendors think about pretty much the bare minimum in all-around security posture, and then have an external audit - as someone who has to approve SaaS vendors it makes my life much easier.

Reply on news.ycombinator.com