DOS via cache poisoning on [developer.mozilla.org]
该报告还没有中文解读。
原文摘录
摘自原文（2153 字符中的一小部分）
Summary: Hello, after some research it appears that it is possible for an attacker to perform a DOS attack on the https://developer.mozilla.org page for an indefinite period. This is possible by adding an header and a value causing an error on the back-end side (error 404), the bad configuration of …
原文中的代码
No information about the caching period is available in the response, but it is anyway possible to reinterpret the manipulation indefinitely. For obvious reasons I performed my tests using a cache-buster - adding a URL parameter as we will see in the POC - so as not to affect the user experience. …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Mozilla 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @zhero_ · 版权归作者与 Mozilla 所有