Harvest: Invoices can be added to any retainers - even closs-platform

ID H1:165862
Type hackerone
Reporter eboda
Modified 2016-10-29T16:11:33



Hey team, there is an IDOR bug, which allows me to add an invoice to any retainer I wish, even if the retainer belongs to another app/subdomain.

Steps to reproduce

  1. Make sure you have two apps A and B
  2. In A create a retainer, let's say it has id 1234.
  3. In B open this link: https://SUBDOMAIN.harvestapp.com/invoices/new?invoice[client_id]=5678&invoice[kind]=retainer&invoice[retainer_id]=1234

    Here 5678 needs to be a valid client id for account B. Then simply fill out the invoice form and save it.

  4. Now in account A go to https://[SUBDOMAIN].harvestapp.com/retainers/1234 and you will see that the invoice from account B was added to this retainer.