地图 / Chat exposed using cookie

Chat exposed using cookie

访问控制 / Reliance on Cookies without Validation and Integrity Checking in a Security Decision / #279070

厂商: Legal Robot
严重程度: 低危
赏金: —
弱点: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
研究员: @sahore
披露日期: 2017-10-19
资产: app.legalrobot.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（836 字符中的一小部分）

Hello **Broken authentication and session management:** Attacker can use cookies of an authenticated user to reads and write the chat on the behalf of user and miss guide the legalrobot team.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Legal Robot 所有。

时间线

2017-10-18报告提交
2017-10-19公开披露

阅读 HackerOne 原文 ↗作者 @sahore · 版权归作者与 Legal Robot 所有

同类报告

Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamidCS Money · 2020-12-20 Able to blocking users with 2fa from login into their accounts by just knowing the SteamIDCS Money · 2023-12-14 · $300 Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesRuby on Rails · 2020-06-16 Reset password cookie leads to account takeoverWeblate · 2020-10-12 Ruby CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parseInternet Bug Bounty · 2022-02-03 · $2,000 [REMOTE] Full Account Takeover At https://██████████████/CAS/U.S. Dept Of Defense · 2019-10-04

Chat exposed using cookie · 破甲 POJIA