Bypass voting restriction due to HTTP Header Injection
该报告还没有中文解读。
原文摘录
摘自原文（1425 字符中的一小部分）
It is possible to bypass the voting restriction by adding a specially crafted HTTP-Header. The underlying algorithm uses the ip address to restirct the voting of a user. However, by manipulating the IP-Adress via adding the HTTP-Header "X-Forwarded-For" it is possible to vote a entry up or down …
原文中的代码
POST /v0/vote HTTP/1.1 Host: api.urbandictionary.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Forwarded-For: 12.34.56.79 Content-Type: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Urban Dictionary 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @schirgel · 版权归作者与 Urban Dictionary 所有