Sensitive data of 400,000 German students exposed by API flaw

guest · Oct 29, 2021

Sensitive data of 400,000 German students exposed by API flaw
October 28, 2021
https://www.bleepingcomputer.com/ne...-400-000-german-students-exposed-by-api-flaw/

Approximately 400,000 users of Scoolio, a student community app widely used in Germany, had sensitive information exposed due to an API flaw in the platform.

Lilith Wittmann, a security researcher from the IT security collective “Zerforchung” discovered the bug and immediately disclosed their findings to the Scoolio team.
Click to expand...

Scoolio is a German student community app that aims to build better time management skills, tutoring, homework planning, and group chats to network with peers. The app also allows companies to network with students to share job openings or internship opportunities.

Scoolio makes money by collecting data generated through these tools and features and then monetizing it with targeted advertising.
Data exposed by leaky API
In Zerforchung's report, Wittmann explains how she exploited Scoolio API flaws to retrieve extremely sensitive data for any user ID used on the app.
Click to expand...

"We cannot say exactly how many students are affected. Because scoolio artificially inflates its user numbers by creating accounts without asking: As soon as you download the app and open it once, an empty profile with a UUID is generated - regardless of whether you actually want to create a user account," explains the Zerforchung report.
Click to expand...

Over 400,000 German Students Data Leaked by a Flawed API

The platform is backed by over three state-owned investment groups, namely Technologiegründerfonds Sachsen, SIB Innovations – und Beteiligungsgesellschaft mbH and Kreissparkasse Bautzen. Thus, it’s trusted by all students and educational institutions in the country, and used in daily life.

While the API flaw was patched now, Wittmann wished for a quicker response considering the nature of the data leak and the simplicity of the patching process. Yet, she was appreciated by Scoolio for the disclosure and assured that none have accessed the exposed records before her.
Click to expand...

Log in or Sign up

Sensitive data of 400,000 German students exposed by API flaw

guest Guest

Log in or Sign up

Sensitive data of 400,000 German students exposed by API flaw

guest Guest

Useful Searches