Notes
Notes - notes.io |
Attachments3:29 PM (38 minutes ago)
to bugs-bounty
Issue Name: Critical :- Sensitive Data Exposure (Google API Keys Stored without restriction)
Product URL: https://play.google.com/store/apps/details?id=com.yatra.base&hl=en_IN
Source: Android APP
Affected Product: Others
Issue Description: Sensitive Data Exposure (Severity - Critical ) *Impact :- Using Google API Keys attacker can make frequently API requests that increase you google console bill. (Find Video POC For better understanding ). Note :- You are paying to google for google map , google place api if attacker made frequently requests using your google api keys its increase your cost. How Attacker Use Your Google API KEY to increase your business cost risk :- API_KEY :- AIzaSyDJFHeNAiE2mna3rX_Cj3RDa5tV6owKZkw 1] Query Autocomplete – Charges 0.00283 USD Per Request. https://maps.googleapis.com/maps/api/place/queryautocomplete/json?key=AIzaSyDJFHeNAiE2mna3rX_Cj3RDa5tV6owKZkw&input=pizza+near%20par 2] Places – Nearby Search :- Charges 0.032 USD Per Request. https://maps.googleapis.com/maps/api/place/nearbysearch/json?location=-33.8670522,151.1957362&radius=1500&type=restaurant&keyword=cruise&key=AIzaSyDJFHeNAiE2mna3rX_Cj3RDa5tV6owKZkw 3] Places – Text Search :- Charges 0.032 USD Per Request. https://maps.googleapis.com/maps/api/place/textsearch/xml?query=restaurants+in+Sydney&key=AIzaSyDJFHeNAiE2mna3rX_Cj3RDa5tV6owKZkw 4] Places – PHOTO :- Charges 0.007 USD Per Request. https://maps.googleapis.com/maps/api/place/photo?maxwidth=400&photoreference=CnRtAAAATLZNl354RwP_9UKbQ_5Psy40texXePv4oAlgP4qNEkdIrkyse7rPXYGd9D_Uj1rVsQdWT4oRz4QrYAJNpFX7rzqqMlZw2h2E2y5IKMUZ7ouD_SlcHxYq1yL4KbKUv3qtWgTK0A6QbGh87GB3sscrHRIQiG2RrmU_jF4tENr9wGS_YxoUSSDrYjWmrNfeEHSGSc3FyhNLlBU&key=AIzaSyDJFHeNAiE2mna3rX_Cj3RDa5tV6owKZkw 5] Place Autocomplete (Per character):- Charges 0.00283 USD Per Request. https://maps.googleapis.com/maps/api/place/autocomplete/json?input=1600+Amphitheatre&key=AIzaSyDJFHeNAiE2mna3rX_Cj3RDa5tV6owKZkw&sessiontoken=1234567890 6] Place Details :- Charges 0.017 USD Per Request. https://maps.googleapis.com/maps/api/place/details/json?placeid=ChIJN1t_tDeuEmsRUsoyG83frY4&fields=name,rating,formatted_phone_number&key=AIzaSyDJFHeNAiE2mna3rX_Cj3RDa5tV6owKZkw Mitigation :- (Follow the official documentation to provide restrictions to API) https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions Official API Charges List :- https://developers.google.com/places/web-service/usage-and-billing Note :- Few developer or tester say its normal issue but i will demonstrate you how i use your google api keys for my use. (Find POC Video) VIDEO POC :- https://drive.google.com/file/d/1VODZuy53-2YhQvaZGCVbmBY52BG4nAn2/view?usp=sharing I hope you understand this issue. Please feel free to contact me if you need any further information. Thank You.
Reproduction Steps: *Replication Steps :- 1] Download APK file from https://play.google.com/store/apps/details?id=com.yatra.base&hl=en_IN 2] Use any reverse engineering tool to decompile apk. (i am using Appie and APKTool) 3] Find The following path and open file using any text editor :- res/values/strings.xml 4] In strings.xml you stored all api key in hardcoded format.
Name: Saddam Maniyar
Email: [email protected]
Mobile: 7020542379
Best Time to Contact: 10 AM - 12 PM
|
|
Notes.io is a web-based application for taking notes. You can take your notes and share with others people. If you like taking long notes, notes.io is designed for you. To date, over 8,000,000,000 notes created and continuing...
With notes.io;
- * You can take a note from anywhere and any device with internet connection.
- * You can share the notes in social platforms (YouTube, Facebook, Twitter, instagram etc.).
- * You can quickly share your contents without website, blog and e-mail.
- * You don't need to create any Account to share a note. As you wish you can use quick, easy and best shortened notes with sms, websites, e-mail, or messaging services (WhatsApp, iMessage, Telegram, Signal).
- * Notes.io has fabulous infrastructure design for a short link and allows you to share the note as an easy and understandable link.
Fast: Notes.io is built for speed and performance. You can take a notes quickly and browse your archive.
Easy: Notes.io doesn’t require installation. Just write and share note!
Short: Notes.io’s url just 8 character. You’ll get shorten link of your note when you want to share. (Ex: notes.io/q )
Free: Notes.io works for 12 years and has been free since the day it was started.
You immediately create your first note and start sharing with the ones you wish. If you want to contact us, you can use the following communication channels;
Email: [email protected]
Twitter: http://twitter.com/notesio
Instagram: http://instagram.com/notes.io
Facebook: http://facebook.com/notesio
Regards;
Notes.io Team
