Security Researcher Discovers Vulnerabilities in Electric Scooter Backend

Initial Discovery and Reconnaissance

A security researcher began investigating an electric scooter company after its launch in their city. The initial phase involved identifying the company and understanding the user flow for scooter rental. Subdomain enumeration of electricscootercompany.com.br revealed several hosts, including a WordPress marketing site, a REST API for clients, and an Angular-based administrative panel.

Exposed Administrative Panel

The administrative panel, located at painel.electricscootercompany.com.br, was discovered through subdomain enumeration and was not linked from the main website. This panel was publicly accessible without authentication, allowing anyone to load the production Angular application. Analysis of the application's JavaScript bundles revealed 83 distinct endpoints.

Backend Functionality and Vulnerabilities

The identified endpoints covered critical functionalities such as user and permission management, vehicle control, trip activation and finalization, IoT device interaction, and financial modules. Although direct access to these protected routes initially resulted in HTTP 401 errors due to authentication requirements, the exposure of the panel itself indicated a significant security oversight. The researcher attempted various methods to bypass authentication, including direct route access, unsigned JWTs, and token tampering.

Potential for Unauthorized Access

The presence of an exposed administrative panel with extensive backend endpoints suggests a potential for unauthorized access and control over the scooter fleet. If authentication mechanisms were bypassed, an attacker could remotely unlock scooters, manipulate user data, or interfere with operational logistics. The specific company details were anonymized by the researcher to protect the entity involved.