# Unrestricted Access to Celery Flower Instance

Unauthenticated Celery Flower dashboard exposed at /pim/flower/ on api.excalls.mobi let anyone list workers/tasks, revoke jobs, and potentially async-apply arbitrary tasks.

- Payout: hidden
- Severity: high
- Program: EXNESS
- Found by: ashwarya
- Disclosed: 2023-12-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2264960
- Library page: https://bugbountylibrary.com/r/h1%3A2264960
- Tags: area:web domain:api domain:web impact:integrity impact:internal-access kind:bounty platform:hackerone sev:high tech:python vuln:access-control vuln:auth-bypass vuln:info-disclosure vuln:rce

**Target:** Celery Flower monitoring API behind PIM mobile route
**Root cause:** Flower was deployed with flower_unauthenticated_api enabled and proxied publicly through the /pim/flower/* mobile route without auth.
**Steps:**
1. Request `https://api.excalls.mobi/pim/flower/api/workers` and observe worker list returned without authentication
2. Request `https://api.excalls.mobi/pim/flower/api/tasks` to enumerate tasks and sensitive data
3. Request `https://api.excalls.mobi/pim/flower/api/task/info/dc58fcb7-be31-4f4e-aeff-5837f0c32d30` to read individual task details
4. Use `/api/task/async-apply/*` to submit tasks asynchronously to the worker
**How found:** Researcher noticed the PIM mobile route proxied Flower and probed the API endpoints to confirm no authentication was enforced.
**Exploitation:** Attacker directly hits the unauthenticated Flower API to enumerate workers and tasks, revoke/terminate tasks, and submit tasks via async-apply, potentially achieving code execution on the Celery worker; researcher stopped short of RCE in prod.
**Escalation:** Task submission via /api/task/async-apply/* could escalate from info disclosure to arbitrary code execution on the worker.
**Insight:** Mobile app API prefixes (/pim/, /mobile/) often reverse-proxy internal admin tooling like Flower, Kibana or Grafana; enumerate known dashboard API paths under those prefixes rather than only the root host.

## Proof of concept (copied exactly from the original report)

**Unauthenticated Flower API endpoints exposed**

```
https://api.excalls.mobi/pim/flower/api/workers
https://api.excalls.mobi/pim/flower/api/tasks
https://api.excalls.mobi/pim/flower/api/task/info/dc58fcb7-be31-4f4e-aeff-5837f0c32d30
```