RedBus and MakeMyTrip Limited, two of India’s biggest online travel agencies, allow users to reserve free seats.
Mr. Vishnu Thulasidoss had intended to go to his hometown a few months ago when he was interning in Chennai for several reasons. He was searching Redbus for a bus ticket as a result.
He claimed that a single seat cost roughly 1300 rupees and a double seat cost about 1200.
He decided to take the double seat to save that extra 100 Rs.
Riding In Two Seats At The Same Time
The seat will essentially be locked for a certain amount of time, known as the lock-in period when a user chooses a seat and navigates to the payment page to prevent several users from booking the same seat.
Hence, the client should request an API to the server in the background.
“This API request should be responsible for locking the seat. If I could capture this request for a seat, and replay it at regular intervals, then I can lock the seat forever”, Vishnu Thulasidoss explained.
He switched on Burp suite, then, while using Burp to capture the traffic, he navigated to redbus[.]in and tried booking a seat.
Burp Suite is the class-leading vulnerability scanning, penetration testing, and web app security platform.
After intercepting the queries briefly, he discovered that the seat was being locked using a post request to the endpoint [“https://redbus.in/…/…”].
He created a Python script that resends this request every 10 minutes (the lock-in time) when installed on the cloud.
“This lets me travel freely in two seats without any disturbance just by paying for a single seat. But I can’t use it practically”, he said.
“Even if I lock the seat forever, those greedy bus conductors would pick up someone from the roads who are waiting for a bus. So, technically the other seat will always be filled.”
On MakeMyTrip and ClearTrip, he examined the same flaw as well. Once more, it worked.
A Bounty was Awarded
So, he reported the bug and programmatically locked every seat in a bus while recording the PoC to add some spice to the proceedings. He then informed their security team via email about the problem.
He soon received an Amazon gift card for 10,000 rupees from Redbus.MakeMyTrip paid him a bounty of 13,500 Rupees and added him to their Hall of Fame after reporting the bug.
They rejected the report on ClearTrip, saying that it was intended to be a feature rather than a bug.
Struggling to Apply The Security Patch in Your System? –
Try All-in-One Patch Manager Plus