Yelp for Business: locked Email field silently editable via API
业务逻辑 / Client-Side Enforcement of Server-Side Security / #3766455
该报告还没有中文解读。
原文摘录
摘自原文（5758 字符中的一小部分）
The Account Information screen in the Yelp Biz Android app renders the Email field as read-only with a lock icon; the screen exposes no editor. The Save action calls `POST https://biz-app.yelp.com/account/info/bio/v1`. The endpoint accepts and applies an attacker-supplied `email` value with no …
原文中的代码
POST https://graphql-mobile-api.yelp.com/gql/mobile x-auth-token: <victim_token> x-biz-auth-token: <victim_token> operation-name: GetAccountInfo accept: multipart/mixed;deferSpec=20220824, application/graphql-response+json, application/json content-type: application/json; …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Yelp 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @0xmanticore · 版权归作者与 Yelp 所有