HN Explorer

The Trainline (UK) website has a ridiculous security flaw and refuses to fix it

5 points by scottmf ↗ HN
The Trainline deals with the private data of ~11 million UK residents' data every month, but doesn't seem to care much about security. Posting this publicly appears to be the only way they'll fix it.

I brought this to the The Trainline's attention through Twitter DM almost a year ago. They said they'd pass it along to the security team.

I've also spoken directly with a Trainline employee about this issue. He went straight to the security team, who had apparently been aware for some time and "hoped no one would find out".

Almost a year later and nothing has been done.

Note: this doesn't work if someone has signed up for an account with that email address (although it's not required to purchase tickets, many frequent users probably have an account).

How to view someone's personal information and access their ticket history (and refund or use any recently purchased tickets)

1. Sign up for a Trainline account using their email address

2. You're immediately signed in without verifying that you own the email

3. You have full access to their information/tickets.

Yup, it's that easy.

2 comments

[ 3.2 ms ] story [ 14.6 ms ] thread
gargravarr
Truly ridiculous, especially if they aren't taking it seriously, but you say this only affects users who check out as a guest? That does limit the scope, at least. I can confirm that attempting to register a new account with the same email address does error out as expected.

Upvoting to bring this to someone's attention.

scottmf
Yeah the scope is limited to those without accounts.

Try signing up with any other email address and you're immediately signed in — after being asked for the password you just chose, for security reasons.