In a post to Twitter, Indian bug bounty hunter Swarnim Patwa (@Try_hopper) shared details of an unexpected windfall thanks to some simple research and discovery of what turned out to be a serious misconfiguration on the part of Zerodha.
Patwa, who frequently scans the assets of bug bounty and vulnerability disclosure targets late at night when systems are often less defend, found that stock brokerage Zerodha was exposing an origin IP that was not protected by any CDN or WAF.
This meant that Patwa had direct access to the brokerage’s backend infrastructure, which presented a range of opportunities, including bypassing rate limits, the ability to perform unregulated fuzzing, and the ability to brute force attack at full throttle.
Patwa reported the issue to Zerodha via the company’s bug bounty platform, and while the company decided not to fix the issue, it did reward the researcher with a handsome bounty.