Ordering Starbucks through your phone might get you more than just coffee
Venti vulnerability in Starbucks mobile platform has now been patched
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A security researcher has discovered a potential remote code execution (RCE) vulnerability in one of Starbuck’s mobile domains which has now been patched.
As many other large companies do, the US coffee giant has abug bounty programonHackerOneand it was there that Kamil “ko2sec” Onur Özkaleli submitted a vulnerability report back in November that was recently made public.
According to theadvisory, ko2sec discovered an .ashx endpoint designed for handling image files on a platform for Starbucks customers in Singapore at the website, mobile.starbucks.com.sg. While theendpointwas meant for image files, it did not restrict file type uploads so an attacker could potentially exploit this to upload malicious files instead and remotely execute arbitrary code.
Starbucks has not made all of the details of the bug bounty report public but it did note that ko2sec’s analysis revealed that “additional endpoints on other out of scope domains that shared this vulnerability”.
Starbucks bug bounty program
While a CVE has not been issued for this critical vulnerability, a severity score of 9.8 was added to the report and ko2sec received $5,600 for his work.
However, this isn’t the first vulnerability that ko2sec has found in Starbucks Singapore’s website. Back in October, he discovered anaccount takeoverexploit in the company’s site caused by open test environments. This bug could be exploited to target users by their email addresses, view their personal information and use any credit loaded in their account wallets to make purchases.
Ko2sec received $6,000 for his work on this report and since launching its bug bounty program on HackerOne back in 2016,Starbuckshas received 1068 vulnerability reports on the platform and paid out $640,000 in bounties to security researchers.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
ViaZDNet
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
