Flaw in property inventory website exposed thousands of users’ home contents

guest · Jun 12, 2020

Flaw in property inventory website exposed thousands of users’ home contents
Inventory Hive bug served up internal and external property images, along with members’ contact details
June 10, 2020 (Updated: June 11, 2020)
https://portswigger.net/daily-swig/...site-exposed-thousands-of-users-home-contents

A vulnerability in the website of Inventory Hive, a property inventory service, was leaking members’ personal information, including their name and address, along with internal and external property images.

According to the security researcher who discovered the issue, the vulnerability offered would-be burglars not only a blueprint to “hundreds of thousands” of users’ homes, but also a readymade ‘shopping list’ of items the properties contained.

“A malicious user/thief had all the information needed to enter the [property],” researcher Marco Menozzi told The Daily Swig.
“This included details of the user (name, address); list/pictures of the user’s goods inside the apartment; detailed, high-resolution pictures of the entrance lock; and pictures of house intrusion alarms.”
Click to expand...

Token security
Responding to questions from The Daily Swig this week, an Inventory Hive spokesperson said: “We were indeed made aware of a vulnerability… which was remediated as quickly as possible.”

In a security advisory issued on Monday (June 8), the UK-based property inventory company confirmed that the vulnerability could have allowed an unauthenticated user to view the gallery section of a completed report.

“The vulnerability was caused by a missing check on an authentication token passed as a GET parameter, and as long as a token was present it was not properly checked,” the company explained.
Click to expand...

Log in or Sign up

Flaw in property inventory website exposed thousands of users’ home contents

guest Guest

Log in or Sign up

Flaw in property inventory website exposed thousands of users’ home contents

guest Guest

Useful Searches