https://hashbang.ca/tag/vuln Recent content in Vuln on Hashbang.ca Hugo en-us Thu, 11 Dec 2014 02:00:00 -0700 https://hashbang.ca/post/csrf-vulnerability-at-cloudatcost-com Thu, 11 Dec 2014 02:00:00 -0700 https://hashbang.ca/post/csrf-vulnerability-at-cloudatcost-com/ <p><a href="http://cloudatcost.com">CloudAtCost.com</a> provides low-cost virtual machines hosted in Canada. <code>panel.cloudatcost.com</code> is the management interface, where customers can install OS images, access a console, etc.</p> <figure class="captioned alignright scaled"> <img src="https://hashbang.ca/images/system-security-breach.jpg" alt="A square black indicator light labelled SYSTEM SECURITY BREACH, mounted in a blue plastic panel" srcset="https://hashbang.ca/images/system-security-breach.jpg 400w, https://hashbang.ca/images/system-security-breach-800.jpg 800w, https://hashbang.ca/images/system-security-breach-1200.jpg 1200w" sizes="(min-width: 55rem) 22rem, (min-width: 45rem) calc(100vw - 19rem), calc(100vw - 4rem)" width="400" height="300" /> <figcaption><a href="https://commons.wikimedia.org/wiki/File:System_security_breach_%286882749323%29.jpg">System security breach</a> by Jeff Keyzer, <a href="https://creativecommons.org/licenses/by-sa/2.0/">CC BY-SA 2.0</a>; resized</figcaption> </figure> <p>A <a href="https://cwe.mitre.org/data/definitions/352.html">cross-site request forgery</a> (CSRF) vulnerability was discovered in this web application. If a customer could be tricked into visiting a crafted URL while logged in, an attacker could change the victim&rsquo;s password, gaining access to the management interface.</p>