# Payment method token being sent to 3rd party analytics service

Payment method tokens leaked to third-party analytics and reusable across accounts, letting an attacker link another user's credit card to their own account.

- Payout: hidden
- Severity: high
- Program: Upserve 
- Found by: ctulhu
- Disclosed: 2021-09-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/637267
- Library page: https://bugbountylibrary.com/r/h1%3A637267
- Tags: area:web3 domain:web impact:funds-loss impact:integrity kind:bounty platform:hackerone sev:high tech:payment vuln:access-control vuln:business-logic vuln:info-disclosure

**Target:** app.upserve.com online ordering / orders.upserve.com payment linking
**Root cause:** Payment method tokens were sent to a third-party analytics service and were not bound to the originating user account, so a captured token could be replayed to link the card to a different account.
**Steps:**
1. Create two accounts on app.upserve.com (juandelacruz@gmail.com, juandoe@gmail.com).
2. Add a credit card to each account while capturing all requests.
3. Remove the card linked to juandoe@gmail.com.
4. Replay the payment_method_token from juandelacruz@gmail.com in the orders.upserve.com link-card request for juandoe@gmail.com.
5. Card is now linked to juandoe@gmail.com; note last_four and card_type fields are accepted unvalidated.
**How found:** Researcher captured requests during card linking, noticed payment_method_token in the redirect URL and orders.upserve.com request, and observed the token was also transmitted to a third-party analytics service; then tested replaying a token across accounts.
**Exploitation:** Attacker obtains a victim's payment_method_token (e.g. from the third-party analytics service) and submits it in the link-card request to orders.upserve.com under their own account, attaching the victim's card as a payment method.
**Escalation:** Access to the third-party analytics account would expose tokens at scale, enabling mass card-linking fraud.
**Insight:** Watch where sensitive tokens appear in redirect URLs and third-party analytics beacons; then test whether those tokens are bound to the user/session or freely replayable across accounts.