Penetration test · Manual · first seen 2 Oct · CWE-639
CriticalConfirmed exploitableIn progressChidi Ezefix by 9 Oct, 9 days late
Reproduced by the tester · app.tessellatepay.com
The ownership check is in review; the pentest team will retest once it ships.
One problem in one place, found by manual. Proven in one.
1 source · 1 place
Manual
Vernovi penetration test, 28 Sep to 2 Oct
Reported by Vernovi penetration test
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
2nd of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
90 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
Vernovi penetration test, 28 Sep to 2 Oct · reported Fri 2 Oct, 15:30
The payouts endpoint checks that you're signed in, not that the payout is yours. Changing the ID in the address returns another merchant's payout: amount, beneficiary name, bank and account number.
How to reproduce it
The fix
Load the payout with the signed-in merchant's ID in the query (WHERE id = $1 AND merchant_id = $2) and answer 404 when it isn't theirs. Check every /api/*/{id} route the same way.
What the tester sent
GET /api/payouts/po_8k2m4q7z1x HTTP/2 Host: app.tessellatepay.com Cookie: sa_session=•••••••• (merchant A)
What came back
HTTP/2 200
{"id":"po_8k2m4q7z1x","merchant":"mrc_9f…(merchant B)","amount":4250000,"beneficiary":{"name":"O•••• Ventures","bank":"058","account":"01••••••41"}}CWE-639 · GET /api/payouts/{id} on app.tessellatepay.com
What happened, and what was said
3 events · 0 comments · oldest first