search

FundRequest / platform

FundRequest platform code (core)
https://fundrequest.io
MIT License
109 stars 25 forks source link

As a security auditor I log a medium security breach in FundRequest platform #543

Closed akhilcryptos closed 6 years ago

akhilcryptos commented 6 years ago

Vulnerabilities Found :

1 : CSRF to update ETH wallet address in victims account 2 : Victims account takeover using password reset link hijacking via host header poisoning

Proposed solution : for vulnerability 1 : Add CSRF Tokens for vulnerbaility 2 : Refer http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html

Verification : The team has fixed the reported vulnerabilites