This issue was responsibly disclosed to the vendor, acknowledged, and subsequently remediated
A set of access control vulnerabilities was identified in the WestFAX porting portal allowing unauthorized access to sensitive customer porting data and uploaded documents. The issues include:
- Insecure Direct Object Reference (IDOR) in port request viewing
- IDOR in port request modification endpoint
- Unauthenticated access to uploaded documents (LOAs, bills)
These issues result in exposure of personally identifiable information (PII) and sensitive telecom provisioning data.
https://porting.westfax.com/view_port_request.php?id={id}
https://porting.westfax.com/edit_port_request.php?id={id}
https://porting.westfax.com/uploads/{document_identifier}
The id parameter in the port request view endpoint is not properly bound to the authenticated user session.
By modifying the id value, an attacker can access other users’ port requests without authorization.
Impacted Data:
- Customer name
- Email address
- Phone number
- WestFAX account number
- Account number and PIN fields
- Authorized contact information
- Billing Telephone Number (BTN)
- Service account metadata
- Physical address
The edit endpoint suffers from the same authorization flaw. Arbitrary port requests can be modified by changing the id parameter.
Potential impact:
- Modification of port request details
- Tampering with active porting workflows
- Disruption or cancellation of legitimate requests
- Fraudulent updates to customer records
Uploaded files associated with port requests (e.g., LOAs and billing documents) are accessible directly via enumerable URLs. Document identifiers were exposed within port request responses, enabling direct retrieval of uploaded files.
Example pattern:
https://porting.westfax.com/uploads/{file_identifier}.pdf
Impact:
- Exposure of signed Letters of Authorization (LOAs)
- Utility bills and verification documents
- Sensitive customer and organizational metadata