checking mpesa users balance

 

Hello guys,

This bug affected an api on a third party merchant integrating with mpesa so it was not on scope of safaricom bug bounty on hackerone program.

The bug was reported and fixed.i will use redacted.com to refer to the affected site.Sorry,i won't provide screenshots 

It is a popular e-commerce site in kenya.i was able to use a logic bug(error message to know anyone's mpesa balance).The downside of using this  method was getting mpesa STK pop up notification by the  victim.The pro is that you don't need the victim to do anything(0 click).you just needing to know the phone number!

How?

I clicked the items and added to the shopping cart.Clicking the cart sends you to the payment page.here they use a custom API(api.redacted.com) ,add your victim mpesa number and continue to pay for the item.

Here is where the vulnerability lies.If the victim number has enough cash in mpesa ,they receive STK push  notification to pay and on the site you receive a 200 error stating to contact merchant. In that case you know the victim has enough cash to pay for that item in his/her mpesa but they have not entered their Pin. otherwise, you receive an error stating the "number doesn't have enough balance"

As the site didn't have rate limit in place you could send multiple request and establish exact mpesa balance of the user. 

Impact?

I think knowing anyone's mpesa balance is in violation of their privacy.Also the bug could be used by bad actors who do sim swap to find users to target.other impact you can come up with yourself

The fix in place gives same error when user doesn't have enough cash in his mpesa account or fails to provide mpesa Pin in the pop up.

Lesson

securing your infrastructure is not enough as third party issues can pose threats to your system.