Exploiting McDonald's APIs to hijack deliveries and order food for a penny

A security researcher discovered multiple vulnerabilities in McDonald's McDelivery system in India, allowing for significant exploits. These included the ability to order food for just ₹1 (approximately $0.01), hijack other users' delivery orders, access sensitive information such as driver details, and manipulate order invoices. The researcher identified flaws primarily related to Broken Object Level Authorization (BOLA) and Broken Object Property Level Authorization (BOPLA), which enabled unauthorized access to order details and the ability to alter prices during the checkout process. Despite McDonald's having a bug bounty program in India, the researcher noted that the system had not been adequately secured since a previous data leak in 2017. The vulnerabilities were exploited through a series of API calls, revealing that the system's design allowed for easy manipulation of order IDs and other parameters. The researcher ultimately created an account without verification and successfully placed an order at a manipulated price, highlighting the need for improved security measures in the application.

- McDonald's McDelivery system in India had significant API vulnerabilities.

- Users could order food for just ₹1 and hijack other users' orders.

- Sensitive driver information was accessible through the system.

- The researcher exploited flaws related to BOLA and BOPLA.

- The findings emphasize the need for enhanced security protocols in food delivery applications.