Security Flaw in Justdial

What Is Justdial?

Justdial provides a local search for different types of services in India over the phone and online.

What Is The Flaw?

One of their Internal API can log you into any Justdial account bypassing your phone number into the request, and in response, it returns with the access token, SID, and UID. 

SID can be used to access your Justdial Pay account, and UID can be used to access and Post on your Justdial Social Profile.

Why Is It Big?

Justdial has a database of approximately 26.5 million listings as of June 30, 2019. It has 156.1 million quarterly unique users across the web, mobile, App & voice platforms as of June 30, 2019. Justdial users have contributed 99,828,043 reviews and ratings for various listings, to date. (Source: Justdial )

These 156.1 million Users are at risk of getting their information leaked on the web.

Hackers and Telemarketers can mine the data of Justdial by automating a script using a phone number dump found online.

The hackers can also access your Justdial Pay account and receive funds on your behalf by entering their bank account information in the Bank Details Settings, but they cannot transfer the funds as it requires them to have access to your bank account/UPI code.

How Do I Reproduce The Flaw?

–I have created two automated scripts for demonstrating the flaw, It will auto-generate the Social UID, SID & Access token for your phone number and log you into your Justdial Pay Account and the second script allows you to post on any Justdial users account.

Note – Some of the features such as Sending money, Scanning the code might not work as this URL as it uses your phone’s internal API. But Rest all the features can be used.

For our test, we are going to use disposable phone numbers from receive-sms-online.info

• 7429598517
• 7429581483