Session Fixiation allow attacker to create new evil workspace without being logged in [ Insecure Session management ]
该报告还没有中文解读。
原文摘录
摘自原文（2925 字符中的一小部分）
Hello, How are you, hope you are doing great in this pandemic. While testing again for the session management related bugs in your application, i found some session related issue where evil person can easily create new workspace from victims account without being logged in, that mean the session of …
原文中的代码
HTTP/2 500 Internal Server Error Content-Type: text/plain; charset=utf-8 Content-Length: 21 Date: Fri, 03 Sep 2021 06:33:49 GMT X-Amzn-Requestid: ece1b8ef-c45a-4ea8-955d-26e98e8a4308 X-Amzn-Remapped-Content-Length: 21 X-Amz-Apigw-Id: FEs4MGmEoAMF0ng= X-Amzn-Trace-Id: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Courier 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @basant0x01 · 版权归作者与 Courier 所有