A tenancy bug that let one merchant read another's settlements
Authorisation was enforced at the gateway and assumed everywhere behind it. One internal endpoint had never been given the memo.
- client
- A pan-African payments platform
- sector
- Financial services
- service
- Application security
- duration
- Retained, 14 months
The platform had grown from one country to nine in three years. Its authorisation model had been designed for the first country and extended by convention rather than by code.
Financial services
Built a threat model per service and found four places where tenancy was enforced by convention.
Wrote an abuse-case suite that asserts cross-tenant denial on every route, and handed it to their QA team.
Reviewed the settlement service line by line with two of their engineers in the room.
Stayed for the fix, the retest, and the postmortem.
| ref | finding | severity |
|---|---|---|
| DW-2518-02 | Missing tenancy assertion on internal settlement export | critical |
| DW-2518-05 | Authorisation enforced at gateway only, assumed downstream | high |
| DW-2518-11 | Merchant identifiers sequential and guessable | medium |
| DW-2518-02R | Retest: cross-tenant access denied on all routes | resolved |
The specific bug was closed in six hours. The class of bug was closed by a test that now fails the build, which is the part that mattered.
The report was the least valuable thing they gave us. The failing test in our pipeline was the most.
tell us what you would least like us to reach
Scoping is a conversation with the people who own the systems, not a form. Twenty minutes is usually enough to tell whether we are the right practice for the problem.