TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Taking over Azure DevOps accounts with one click

118 点作者 infosecau将近 5 年前

6 条评论

marshallford将近 5 年前
Does the $3000 (USD?) bounty seem low to anyone else? Prior to reading the timeline section at the bottom of the post I would have guessed a range of 25k to 50k as a bounty for such a severe vulnerability.
评论 #23711370 未加载
评论 #23710340 未加载
评论 #23710369 未加载
评论 #23712439 未加载
lmeyerov将近 5 年前
FWIW, we&#x27;ve had a lot of fun doing web inventory mapping via OWASP OMASS (<a href="https:&#x2F;&#x2F;github.com&#x2F;OWASP&#x2F;Amass" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;OWASP&#x2F;Amass</a>): enumerate via amass -&gt; dump into neo4j or just csv&#x2F;json -&gt; explore with jupyter&#x2F;graphistry.<p>A <i>lot</i> of bug bounties have been getting paid out this way. I can&#x27;t share the details, but we did it as a graph analytics demo with a financial partner bigger than many countries, and 30min later, tickets filed. IMO every sec team &gt; 5 people should have something like this setup.
eganist将近 5 年前
That bounty is an order of magnitude smaller than it should&#x27;ve been. It&#x27;s an account takeover defect that most anyone could fall for because of the structure of the payload URL.
评论 #23711504 未加载
评论 #23709798 未加载
tcmb将近 5 年前
Being awarded a bug bounty suggests that there was a bug that was fixed. But this was actually a misconfiguration, wasn&#x27;t it? Any Azure account with a dangling subdomain and unrestricted reply-to is still vulnerable to this attack, correct?
评论 #23710549 未加载
lowwave将近 5 年前
It is kind funny (or click-baitish) articles with &quot;one click&quot; seems. From a developer point of view, pretty much anything can be done with just one click.
评论 #23713333 未加载
magma17将近 5 年前
stupid user action is needed, so it&#x27;s not a critical bug.