POJIA破甲
地图 / 2 Cache Poisoning Attack Methods Affect Core Functionality www.exodus.com

2 Cache Poisoning Attack Methods Affect Core Functionality www.exodus.com

注入与走私 / Unlabeled / #1581454

厂商
Exodus
严重程度
中危
赏金
—
弱点
Unlabeled
研究员
@setiawan_
披露日期
2022-06-06
资产
*.exodus.com
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(3531 字符中的一小部分)
Summary: www.exodus.com hosts static js and css files on Server: cloudflare . Which is cached by cloudflare and passed to all other users accessing the source. I was able to impact the core functionality by using a custom HTTP. Here are 2 details of the Bug.
原文中的代码
ERROR /webpack-runtime-d5cfa86b8e358efc5db3-v2.js?cachebust=exodus HTTP/1.1
Host: www.exodus.com

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Exodus 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @setiawan_ · 版权归作者与 Exodus 所有

同类报告

CRLF injectionX / xAI · 2019-12-25HTTP request smuggling (?) canpol.deti.mail.ruMail.ru · — · $5,000SSRF via host header let access localhost via https://go.dialexa.comIBM · 2024-10-03Host Header AttacRubyGems · 2025-02-08Host Header Injection - internal.qa.delivery.indrive.cominDrive · 2024-02-12HTTP Response Splitting (CRLF injection) in report_storyX / xAI · 2015-04-21