elections.k8s.io uses weak session secret key, may place elections at risk
该报告还没有中文解读。
原文摘录
摘自原文（2068 字符中的一小部分）
Summary Hi there, I have been working on a new tool to detect misconfigured session signing across bug bounty programs, called CookieMonster. Many applications use stateless cookies to preserve session information (i.e. who has logged in), but many applications do not properly secure this. @nagli …
原文中的代码
# Encryption Key
#
# This is used by the Flask server and should be set to a random character
# string, please do not deploy before doing this!.
SECRET_KEY = env('APP_KEY', 'test')默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Kubernetes 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @ian · 版权归作者与 Kubernetes 所有