Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook
该报告还没有中文解读。
原文摘录
摘自原文（4791 字符中的一小部分）
Basecamp's webhook update handler authorises on project visibility instead of account membership. From my own account I repointed and deleted a webhook owned by an All-access project in an account I never joined.
原文中的代码
attacker identity 28665850 accounts [6267386] victim identity 28662102 accounts [6266520]
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Basecamp 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @deivizzzz · 版权归作者与 Basecamp 所有