Stripe

Stripe 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 访问控制6
• 身份认证3
• 错误配置3
• 跨站请求伪造3
• 不安全的直接对象引用3
• 跨站脚本2
• 业务逻辑2
• 服务端请求伪造2
• 注入与走私1
• 其他弱点1

主要弱点

• 访问控制缺陷（通用）5
• IDOR3
• 跨站请求伪造3
• 错误配置2
• SSRF2
• XSS（通用）2
• Authentication Bypass Using an Alternate Path or Channel2
• 违反安全设计原则（按标题归类）1
• 业务逻辑错误1
• 认证缺陷（通用）1

常见资产

• Stripe DashboardOTHER · 7
• app.taxjar.comURL · 7
• Stripe Open SourceOTHER · 5
• api.stripe.comURL · 2
• *.stripe.comURL · 2
• *.indiehackers.comURL · 1
• dashboard.stripe.comURL · 1
• Stripe SDKsOTHER · 1

高票报告

当前状态 26 份 · 全部 26

1. 266
   Fee discounts can be redeemed many times, resulting in unlimited fee-free transactions业务逻辑 · 2023-02-25 · 中危
   $5,000业务逻辑错误
2. 253
   Mass Account Takeover at https://app.taxjar.com/ - No user Interaction身份认证 · 2022-07-11 · 严重
   $0Authentication Bypass Using an Alternate Path or Channel
3. 212
   Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/身份认证 · 2022-10-20 · 高危
   $0Authentication Bypass Using an Alternate Path or Channel
4. 149
   Email change or personal data change on the account.不安全的直接对象引用 · 2022-01-21 · 严重
   $3,000IDOR
5. 131
   Possible XSS vulnerability without a content security bypass跨站脚本 · 2023-05-02 · 中危
   $2,000XSS（通用）
6. 113
   CSRF token validation system is disabled on Stripe Dashboard跨站请求伪造 · 2022-04-02 · 中危
   $0跨站请求伪造
7. 101
   Mass account takeover!错误配置 · 2022-12-22 · 高危
   $0错误配置
8. 100
   User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`不安全的直接对象引用 · 2022-01-19 · 中危
   $0IDOR
9. 87
   CSRF token validation system is disabled on Stripe Dashboard跨站请求伪造 · 2022-06-01 · 中危
   $2,500跨站请求伪造
10. 55
    Promotion code can be used more than redemption limit.业务逻辑 · 2023-02-14 · 低危
    $0TOCTOU 竞态条件
11. 53
    HTML Injection in the Invoice memos field访问控制 · 2023-03-02 · 中危
    $500访问控制缺陷（通用）
12. 51
    Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRF服务端请求伪造 · 2022-03-23 · 低危
    $0SSRF
13. 46
    XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tag跨站脚本 · 2023-05-02 · 中危
    $2,000XSS（通用）
14. 39
    Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443访问控制 · 2022-10-20 · 中危
    $0授权不当
15. 35
    Verifying email bypass访问控制 · 2023-03-04 · 低危
    $0访问控制缺陷（通用）
16. 33
    Fully TaxJar account control and ability to disclose and modify business account settings Due to Broken Access Control in /current_user_data访问控制 · 2022-10-20 · 中危
    $0访问控制缺陷（通用）
17. 26
    The `stripe/veneur` GitHub repository links to a domain `veneur.org`, which is not under stripe's control错误配置 · 2023-07-03 · 低危
    $0错误配置
18. 26
    [Broken Access Control ] Unauthorized Linking accounts & Linked Accounts info DIsclosure访问控制 · 2022-12-21 · 低危
    $0访问控制缺陷（通用）
19. 26
    CSRF in Importing CSV files [app.taxjar.com]跨站请求伪造 · 2023-03-17 · 低危
    $0跨站请求伪造
20. 25
    GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPerson不安全的直接对象引用 · 2022-03-09 · 高危
    $0IDOR
21. 24
    Unauthorized Canceling/Unsubscribe TaxJar account & Payment information DIsclosure访问控制 · 2022-12-21 · 中危
    $0访问控制缺陷（通用）
22. 20
    Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreen其他弱点 · 2022-05-19 · 低危
    $0输入校验不当
23. 20
    Local applications from user's computer can listen for webhooks via insecure gRPC server from stripe-cli身份认证 · 2022-10-20 · 低危
    $0认证缺陷（通用）
24. 20
    Without verifying email and activate account, user can perform all action which are not supposed to be done错误配置 · 2022-07-18 · 低危
    $0违反安全设计原则（按标题归类）
25. 17
    Object injection in `stripe-billing-typographic` GitHub project via /auth/login注入与走私 · 2023-03-06 · 低危
    $0资源注入