The Premium Feature That Was Only One API Request Away

During my security assessment of Public Bug Bounty Program , I noticed that the platform offers multiple subscription tiers, with certain features restricted to paid plans.

One of these premium features is Google Integration, which is only available for customers subscribed to the Standard plan. Users on lower subscription tiers cannot access or configure this integration through the application's interface

Rather than focusing on the frontend restrictions, I wanted to understand how this limitation was enforced. My first step was to inspect the client-side JavaScript responsible for handling the integrations page.

While reviewing the JavaScript files, I discovered that the logic exposed valuable information about the API used to manage restaurant integrations. This provided a starting point for investigating whether the subscription restriction was actually enforced by the backend or merely hidden by the user interface.

While tracing the relevant code, I found two interesting API endpoints.

The first endpoint was responsible for retrieving the list of available integration platforms along with their identifiers. This endpoint exposed the platform IDs required by the application when configuring restaurant integrations.

The second endpoint was far more interesting. During my analysis, I found an endpoint responsible for updating the restaurant's enabled platforms UpdateRestaurantPlatforms. Instead of simply retrieving data, this endpoint accepted an array of platform IDs and updated the integrations associated with the restaurant.

At this point, the attack became straightforward. Since I already knew the identifier of the Google Integration platform from the first endpoint, I modified the request sent to the second endpoint and included the Google Integration platform ID in the platformIds array.

The server accepted the request successfully and immediately enabled Google Integration, even though the restaurant was subscribed to a plan that should not have access to this premium feature.

Some key takeaways from this research are:

• Never trust the frontend. Anything sent by the client can be modified or replayed.
• Always enforce authorization on the server. Every API endpoint should verify that the authenticated user is entitled to perform the requested action.
• Inspect JavaScript carefully. Client-side code often reveals hidden endpoints, object identifiers, and application logic that can lead to valuable findings.
• Compare UI restrictions with API behavior. If a feature is disabled in the interface, verify whether the backend enforces the same restriction.
• Think beyond traditional vulnerabilities. Many impactful bug bounty findings come from business logic and authorization flaws rather than classic injection vulnerabilities.