Client-Controlled API Flag Bypassed B2B Platform’s Credit Controls, Exposing Contact Data
Summary
A security agent found that a B2B platform’s API accepted a client-controlled flag to reveal paywalled contact data without checking account entitlements. The platform fixed the flaw within two hours of triage.
Key points
- A free-tier user could append an API flag to search requests and retrieve unmasked contact records without spending credits.
- The flaw affected access to data including 600M+ business email contacts, 135M+ verified phone numbers, and personal emails present in about half of records.
- The agent mapped API endpoints by analyzing frontend JavaScript bundles and identified a reveal parameter present in the code but omitted by normal interface flows.
- The backend honored the client-supplied flag without validating the user’s credit balance or tier entitlements.
- The platform’s security team validated and remediated the issue in under two hours after triage.
- The article highlights that business-logic and authorization flaws require server-side entitlement checks; conventional pattern-based scanners may not identify valid-looking requests that violate business rules.
Article Details
- Attack Vectors
- A client-controlled `unmaskContactData` flag was appended to a standard free-tier API request, bypassing server-side checks for credit balance and tier entitlements.
- The Red Agent analyzed client-side JavaScript bundles to identify API endpoints and a request parameter, then tested the parameter by replaying a search request with the flag set to `true`.
- Defensive Notes
- Enforce entitlement, pricing, and access-control decisions server-side for every record; do not rely on what the client interface sends or omits.
- The platform's security team reportedly validated and remediated the issue in under two hours on the day it was reported.