Whisper Money Insecure Direct Object Reference Vulnerability Allowing Unauthorized Balance Updates

A vulnerability allowing insecure direct object reference (IDOR) has been identified in Whisper Money, a personal finance application. This issue is present in versions prior to 0.1.5. The vulnerability allows users to update or create account balances in other users' bank accounts.

Impact

Exploitation of this vulnerability allows users to manipulate account balances in other users' bank accounts, potentially leading to unauthorized financial transactions or discrepancies.

Reproduction

The vulnerability can be reproduced by sending a request to the sync/balances endpoint with an account ID that belongs to a different user. This can be done by first creating an account for one user, then using that account ID to update or create a balance while authenticated as a different user.

Remediation

Users can update to Whisper Money version 0.1.5 or later, where this vulnerability has been patched.