# Friend Request Flow Exposes User Data

Zenly's FriendRequestCreate API returned the target user's phone number before the friend request was accepted, exposing PII to anyone knowing a username.

- Payout: hidden
- Severity: medium
- Program: Zenly
- Found by: yetanotherhacker
- Disclosed: 2022-01-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1245741
- Library page: https://bugbountylibrary.com/r/h1%3A1245741
- Tags: area:web domain:api impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest technique:recon vuln:access-control vuln:info-disclosure

**Target:** rpc.znly.co REST endpoints /UserPublicFriends and /FriendRequestCreate
**Root cause:** The /FriendRequestCreate response serialized the target user's full profile including phone number without checking friendship status, and /UserPublicFriends returned the friend list even when not friends.
**Steps:**
1. Set up an intercepting proxy for the Zenly app.
2. Use 'Add by Username' to search a known username; observe `/UserPublicFriends` response leaking the full friend list with usernames.
3. Repeat on a friend's username to walk the social graph.
4. Tap 'ADD AS FRIEND' to trigger `/FriendRequestCreate`; response contains target's phone number (and own) before acceptance.
**How found:** Researcher intercepted network traffic during the 'Add by Username' flow and noticed the `/UserPublicFriends` response contained friend data not shown in the UI, then inspected the `/FriendRequestCreate` response and saw phone numbers present despite no acceptance.
**Exploitation:** Attacker picks a publicly exposed employee (e.g. marketing) via social media, validates username on Zenly, enumerates their friends to find the CEO's username, then sends a friend request to harvest the CEO's phone number for spear-phishing.
**Escalation:** Chained friend-list enumeration to pivot from a low-profile employee to executives, scaling to multiple employees for credible phishing.
**Insight:** Inspect API responses for fields the UI never renders—hidden friend lists and pre-acceptance profile data often bypass the product's stated privacy model; compare response payloads against documented access rules.