Getting free food from Panera Bread (MyPanera Rewards) [FIXED]

Panera Bread is a bakery-café chain that originated as the Saint Louis Bread Company in Missouri.

They offer a loyalty program called MyPanera Rewards, which allow customers to receive discounts and free food for frequent visits.

Below is a Proof of Concept video, demonstrating the ability to redeem the rewards from another person’s account. This insecure direct object reference vulnerability has since been patched by Panera and is no longer exploitable.

Due to the nature of needing multiple accounts to leverage this type of vulnerability, We used Adam Logue‘s account to redeem a “Free Pastry Reward” from my account, since we discovered this vulnerability together.

We found that the vulnerability didn’t actually remove the reward from my account when Adam’s account redeemed it, perpetually allowing this to be exploited over and over again using the same reward.

 

By swapping out the loyalty_card_number with that of another account, we were able to retrieve another person’s rewards. This includes of course a Free Pastry, and whatever other rewards or discounts the account contained.

Here is the JSON information from the response:

Adam and I wrote a quick proof of concept script in python to demonstrate how an attacker could quickly enumerate random account numbers and dumps their rewards. Using a man-in-the-middle proxy, such as Burp Suite, the loyalty_card_number could be substituted in during an checkout to redeem another person’s reward.

 

In this PoC python script, we hard coded the api_token and access_token, rather than deriving them from login because we did not feel it necessary to do more. If we wanted to write a user friendly script to take advantage of this vulnerability we would have prompted a user for their username and password. From there the script would authenticate their accounts and grabbed their api_token and access_token, which would then be substituted in for the ones used in the script above.

Disclosure Timeline

7/22/2015: Vulnerability Discovered.

7/23/2015: Proof of Concept video created.

7/24/2015: First of many attempts to reach out to Panera via email.

7/30/2015: Tried emailing mobilesupport@panerabread.com, the contact email address for their iOS App Store App.

8/10/2015: Attempted reaching out via firstname.lastname@panerabread.com (we googled for the email account schema) to several IT staff members.

9/8/2015: Called Panera Corporate and left message with of Laurie Gonzales in their IT Department.

10/6/2015: Called Customer Service and spoke with a representative named Ashley who was very helpful and took down my contact information so someone could get back with me.

10/8/2015: Receive email from Adam Furtwengler, manager of their CBSS Preventive Analysis team. Sent response email containing PoC video with details explaining the vulnerability. Received response that the PoC would be forwarded to their development teams for further review.

10/14/2015: Sent follow up email.

10/15/2015: Received Response indicating the development team was still looking into the vulnerability.

10/28/2015: Sent another follow up email.

10/30/2015: Received response that the development team has not given any response or indication on the matter. iOS App Store update patches vulnerability. Android application still vulnerable.

11/04/2015: Android application receives Play Store update. Application still vulnerable.

11/06/2015: Panera website ordering system update patches vulnerability when ordering through web browser.

11/14/2015: Android application receives another Play Store update. Vulnerability still present.

01/12/2016: Followed up phone call to Adam Furtwengler. He explained the developers are still actively working on a fix for the android app.

03/30/2016: Sent another “check-in” email following up with Adam Furtwengler.

04/08/2016: Adam Furtwengler responds back with a resolution timeline for patching the android application by late June or July. He also rewarded Ryan and I each with $50 Panera electronic gift cards.

08/02/2016: Android application is patched and old endpoints are decommissioned, making this application no longer vulnerable.

A special thanks to Adam Furtwengler for being very helpful in relaying communication with the dev team, Ashley from Panera Customer Care for relaying my contact information to the appropriate individual, and Adam Logue for assistance with discovery and disclosure of this vulnerability.