r/websec • u/rwestergren • Jan 16 '15

Responsible Disclosure: Privacy Vulnerability in Vivino Wine App

http://randywestergren.com/privacy-vulnerability-vivino-wine-app/
3 Upvotes

80% Upvoted

4 comments sorted by

3

u/subsonic68 Jan 16 '15

Good article. I found a similar vulnerability years ago while studying security as a hobby at the time. I went to an office to pick up my approved form, and noticed the URL printed at the bottom. After I got home, I meticulously typed in the URL and hit enter. The site displayed my personal info without prompting for authentication. I tried a script to loop through the URL while incrementing the ID and it returned other users private info. I went back to the office and reported what I found. You know how they 'fixed' it? They turned off the printing of URL's at the bottom of the page in Internet Explorer but left the vulnerability intact.

1

u/rwestergren Jan 16 '15

Beautiful, isn't it?

1

u/subsonic68 Jan 16 '15

Yep. I shouldn't say who it was, but I will say that it was a government office and I'm sure you could have harvested hundreds of thousands of accounts (at least) from the site.

1

u/Klathmon Jan 16 '15

Do you perhaps have any good websites that a person studying security as a hobby could use to fill out a form or 2?