# Hacking Starbucks and Accessing Nearly 100 Million Customer Records

Path traversal in Starbucks /bff/proxy/ backend-for-frontend reached an internal Microsoft Graph search API exposing ~100M customer accounts and addresses.

- Payout: $4,000
- Severity: critical
- Program: Starbucks
- Credited: Sam Curry
- Disclosed: 2020-06-20
- Write-up quality: 8/10
- Original: https://samcurry.net/hacking-starbucks/
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-starbucks
- Tags: domain:web impact:data-leak impact:pii-leak kind:research platform:research sev:critical tech:rest technique:recon vuln:access-control vuln:info-disclosure vuln:path-traversal

**Target:** Backend-for-frontend proxy endpoint on app.starbucks.com routing to internal Microsoft Graph search service
**Root cause:** The /bff/proxy/ handler passed user-controlled path segments to an internal host without sanitizing backslash traversal sequences, letting requests escape the intended API path to arbitrary internal endpoints.
**Steps:**
1. Observe `/bff/proxy/orchestra/get-user` returns proxied internal data
2. Find parameterized endpoint `/bff/proxy/stream/v1/me/streamItems/:streamItemId`
3. Send `GET /bff/proxy/stream/v1/users/me/streamItems/..\` and note JSON 404 from internal host (traversal works)
4. Bypass WAF blocking `..\..\` by using `web\..\.\..\` pattern
5. Traverse 7 levels back until 400 Bad Request marks internal root
6. Brute force root paths; `search` returns 301 to `/search/`
7. Request `/bff/proxy/stream/v1/users/me/streamItems/web\..\..\..\..\..\..\search\v1\Accounts\` to dump accounts
8. Confirm scale with `?$count=true` returning 99356059; enumerate with `$skip`/`$filter`
**How found:** Noticed suspicious `/bff/proxy/` API calls while buying a gift card, hypothesized a backend-for-frontend routing to an internal host, tested traversal payloads, found a parameterized endpoint where traversal worked, then mapped the internal root via 400/301 differential responses.
**Exploitation:** An unauthenticated attacker could traverse the BFF proxy to the internal Microsoft Graph search service and use OData `$count`, `$skip`, and `$filter` parameters to enumerate and exfiltrate nearly 100 million customer records (names, emails, phone numbers, addresses) and pinpoint specific users.
**Escalation:** Other internal endpoints (billingaddress, card, rewards, offers, keyserver) were reachable and likely allowed modification of gift cards/rewards, though not confirmed.
**Insight:** When a proxy endpoint takes a path parameter, backslash traversal (`..\`) often bypasses WAFs that only block `../`; use 400 vs 404 vs 301 response differentials to map internal roots and detect where the proxy stops sanitizing.