# # Drivers can access the customers phone number, current location without getting their offer accepted!

Driver submitting a bid gets a tender_id that unlocks customer phone and location via getTenderStatus before the offer is accepted.

- Payout: hidden
- Severity: medium
- Program: inDrive
- Found by: bugsv2
- Disclosed: 2024-02-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1785079
- Library page: https://bugbountylibrary.com/r/h1%3A1785079
- Tags: area:web domain:api impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest vuln:access-control vuln:idor vuln:info-disclosure

**Target:** REST API endpoint /api/getTenderStatus on terra-6.indriverapp.com
**Root cause:** getTenderStatus returns full order/customer details (phone, lat/long) to the bidding driver as soon as a tender is created, without checking that the customer accepted the bid.
**Steps:**
1. Log in as driver and receive an order.
2. Submit a bid via `POST /api/driverrequest?...&order_id=<ORDER>&price=33`; response contains `tender.id` and `order_id`.
3. Without customer acceptance, send `POST /api/getTenderStatus?cid=9415&locale=en_US&job_id=<JOB>` with body `order_id=<ORDER>&tender_id=<TENDER>&phone=<PHONE>&token=<TOKEN>&v=7`.
4. Response leaks customer phone number and lat/long.
5. Resolve coordinates via `POST /api/getaddresses` with `type=start&source=order_form`.
**How found:** Researcher observed the driverrequest response creating a tender object with id and order_id, then noticed the subsequent getTenderStatus call only required those two identifiers, hypothesizing it would return data regardless of acceptance state.
**Exploitation:** Any driver who bids on an order obtains the tender_id from the driverrequest response and immediately queries getTenderStatus to harvest the customer's phone number and coordinates, then geocodes them via getaddresses, all before the customer accepts.
**Insight:** When a bid/offer creates a server-side object (tender), test whether status-check endpoints keyed only on that object's id return full order PII before the counterparty accepts — the acceptance gate is often enforced only client-side.