Monday, June 17, 2024

Redbus & MakeMyTrip Bug Let Users Book Free Seats

RedBus and MakeMyTrip Limited, two of India’s biggest online travel agencies, allow users to reserve free seats.

Mr. Vishnu Thulasidoss had intended to go to his hometown a few months ago when he was interning in Chennai for several reasons. He was searching Redbus for a bus ticket as a result.

He claimed that a single seat cost roughly 1300 rupees and a double seat cost about 1200.

He decided to take the double seat to save that extra 100 Rs.

Riding In Two Seats At The Same Time

The seat will essentially be locked for a certain amount of time, known as the lock-in period when a user chooses a seat and navigates to the payment page to prevent several users from booking the same seat. 

Hence, the client should request an API to the server in the background.

“This API request should be responsible for locking the seat. If I could capture this request for a seat, and replay it at regular intervals, then I can lock the seat forever”, Vishnu Thulasidoss explained.

He switched on Burp suite, then, while using Burp to capture the traffic, he navigated to redbus[.]in and tried booking a seat. 

Burp Suite is the class-leading vulnerability scanning, penetration testing, and web app security platform.

After intercepting the queries briefly, he discovered that the seat was being locked using a post request to the endpoint [“…/…”].

He created a Python script that resends this request every 10 minutes (the lock-in time) when installed on the cloud.

Screenshot of Using Burp Suite

“This lets me travel freely in two seats without any disturbance just by paying for a single seat. But I can’t use it practically”, he said.

“Even if I lock the seat forever, those greedy bus conductors would pick up someone from the roads who are waiting for a bus. So, technically the other seat will always be filled.”

On MakeMyTrip and ClearTrip, he examined the same flaw as well. Once more, it worked.

A Bounty was Awarded

So, he reported the bug and programmatically locked every seat in a bus while recording the PoC to add some spice to the proceedings. He then informed their security team via email about the problem.

He soon received an Amazon gift card for 10,000 rupees from Redbus.MakeMyTrip paid him a bounty of 13,500 Rupees and added him to their Hall of Fame after reporting the bug.

They rejected the report on ClearTrip, saying that it was intended to be a feature rather than a bug.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles