(via “Yelp, but for MAGA” turns red over security disclosure, threatens researcher | Ars Technica)
A new application from the "conservative news" site 63red, called 63Red Safe, is advertised as a sort of "Green Book" for the MAGA set. It lets users rate local businesses "from a conservative perspective," according to the app's Google Play listing, "helping insure[sic] you're safe when you shop and eat!" And in this case, "safe" means freedom to wear "Make America Great Again" clothing without having to bear verbal challenge...
...Because the application is build in React Native, a JavaScript- and JSX-based scripting language that basically turns Web apps into "native" Apple iOS and Android applications, the entire architecture of the application is available to anyone who downloads and unpacks it. And in that code, Alderson discovered a few things:
Wallace had left his username, email, and a plaintext password in the code—twice.
There is no authentication for any of the application programming interface calls, so someone could spoof any user—essentially giving them administrative access to the API.
All of the APIs are clearly defined as URLs in the source code.
By using the "Get user by ID" API call, someone could retrieve the user name, email, ban status, and other details on each user account. Passwords were not in this data, but the entire user database could be retrieved by iterating through all the possible first letters or digits of an account ID.
Any user could be blocked using an HTTP Post to the "block" API.
must be the MAGA boys have a hard time finding someone that knows how to code properly?
wide open - textbook stuff.
