Security Flaw Exposed Valid Airline Boarding Passes

guest · Jul 16, 2019

Security Flaw Exposed Valid Airline Boarding Passes
Amadeus Patches Check-In Software Used by Hundreds of Airlines
July 16, 2019
https://www.inforisktoday.com/security-flaw-exposed-valid-airline-boarding-passes-a-12783

A vulnerability in global airline check-in software used by hundreds of airlines could have been exploited to allow users to view other individuals' boarding passes and personal details, warns incident response expert David Stubley [...] who heads Edinburgh, Scotland-based security testing firm and consultancy 7 Elements.

"It was possible to download valid boarding passes - not belonging to the user - for future flights due to an insecure direct object reference weakness within the application," Stubley tells Information Security Media Group.
"Insecure direct object reference or IDOR vulnerabilities occur when an application provides direct access to objects based on user-supplied input, bypassing expected authentication and user access controls."

Amadeus develops travel industry software used by 500 airlines - including United Airlines and Air Canada - as well as hotels, rail and cruise lines, tour operators and others
Click to expand...

Patch Timeline

July 8: Stubley reports vulnerability to Flybe, which reports it to Amadeus on the same day.

July 11: Vulnerability reported to Britain's Civil Aviation Authority. The same day, Flybe reports that Amadeus has received vulnerability notice and is "taking remediation action."

July 15: Amadeus confirms fixes are in place.

July 16: Security advisory published.

Click to expand...

Security advisory: Airline Enumeration within Amadeus Check-in Application

Log in or Sign up

Security Flaw Exposed Valid Airline Boarding Passes

guest Guest

Log in or Sign up

Security Flaw Exposed Valid Airline Boarding Passes

guest Guest

Useful Searches