# Urgent: attacker can access every data source on Bime

Bime's /cube_models.json accepted any datasource_id, letting any user rebind a cube to another tenant's datasource and read its Postgres credentials via /datasources.json.

- Payout: hidden
- Severity: high
- Program: Bime
- Found by: jobert
- Disclosed: 2016-07-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/149907
- Library page: https://bugbountylibrary.com/r/h1%3A149907
- Tags: area:web domain:api domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:idor vuln:info-disclosure

**Target:** /cube_models.json and /datasources.json REST endpoints
**Root cause:** The cube_models.json create/update endpoint trusts a client-supplied datasource_id without verifying ownership, and datasources.json then returns full datasource records including DB host, login and pwd for any datasource the user's session can enumerate.
**Steps:**
1. Sign in as a normal user on https://h1-bugbounty.bime.io and add a CSV data source to create a dashboard.
2. Capture the `POST /cube_models.json` request containing `"datasource_id":723592` and the base64 `cube_schema`.
3. Replay the same POST with `datasource_id` changed to the victim datasource ID (type need not be known).
4. Send `GET /datasources.json` and read the returned records, which include `external_id`, `login`, `url`, `final_type` and `pwd` for other tenants' Postgres backends.
**How found:** Noticed the datasource_id parameter in the normal CSV-import flow and hypothesized it was not ownership-checked, then replayed with a different ID and enumerated datasources.
**Exploitation:** Attacker with any account rebinds a cube model to an arbitrary datasource_id, then lists /datasources.json to harvest hostnames, logins and passwords of every customer's Postgres backend, enabling direct DB access.
**Insight:** In multi-tenant BI/analytics platforms, the object-reference ID in model/cube creation requests is a common IDOR pivot: rebinding a model to a foreign datasource often causes the platform to serialize that datasource's full connection config back to you.