Export and Import Pipelines: Quiet Data Exfiltration Bugs
Exports feel like boring admin chores. They are also bulk read APIs with file-shaped responses. Imports are parsers with side effects. Together they move a lot of data through code paths fewer engineers review than the main CRUD UI.
If you can export another tenant’s dataset or import a document that pulls remote content, you have a bounty-shaped finding.
Export-side hunts
Start from every “Download CSV,” “Export project,” “Backup workspace,” and “Scheduled report” control. Capture the job creation request:
- Does it take raw IDs for resources outside your org?
- Can you widen filters (
org_id,team_id, date ranges) beyond your role? - Does the download URL use a long-lived signed link without auth?
- Are export artifacts stored on a predictable public object path?
Async jobs matter. Create an export as user A, then try downloading the resulting file URL as user B. Many systems authorize job creation and forget file fetch.
Also watch email/webhook delivery of exports — change the destination to an endpoint you control and see if the server still attaches data you should not read (or if you can point webhooks at internal hosts for SSRF).
Import-side hunts
Importers parse zip/CSV/JSON and create objects. Try:
- Records that reference other tenants’ foreign keys
- Nested URLs the server fetches (avatars, attachments, XML external entities in “legacy” formats)
- Oversized or polyglot files that land in privileged processing workers
- Restores from backup that skip membership checks on included IDs
A malicious import that clones private templates from another org is exfiltration via write path — still frame impact as confidentiality.
Chaining with roles
Low-privilege exporters are ideal. A viewer role that can dump all PII as CSV often outranks a flashy reflected XSS for payout. Compare UI permissions with API permissions on /exports and /imports.
Scheduled exports deserve a second pass. A job created when you were an admin may keep running after demotion, or a cron owned by a shared service account may accept a tenant ID you supply in the schedule payload. Change your role, then re-download the next artifact.
Proof without wrecking production
Use two tenants and a unique canary string in a private record. Show that string inside an export obtained by the wrong principal. For SSRF-via-import, hit a collaborator listener, not random internal IPs. Keep file sizes small.
Report details that speed triage
Attach the create-export request, the download request, and a redacted snippet of the file proving cross-tenant data. Recommend authorizing both job creation and artifact read, short-lived signed URLs bound to the requester, and server-side tenant filters identical to interactive list APIs.
Conceptual anchors: OWASP sensitive data exposure themes and CWE-200 (exposure of sensitive information). When imports fetch URLs, add CWE-918.
Bulk features move bulk trust. Authorization must follow every byte out of the building. If the product markets “one-click migration,” assume the import parser is a high-value attack surface and budget time for it early in the assessment.