Add arbitrary content to Password Reset Email
该报告还没有中文解读。
原文摘录
摘自原文（1072 字符中的一小部分）
I noticed the inclusion of `IP Address` in the email sent for password reset. Then I tried including a new *header*, `X-Forwarded-For` to see if the IP Address in the email could change. Though it didn't change it but it did include whatever value that was injected in the header.
原文中的代码
POST /api/v1/users/reset_password HTTP/1.1 Host: wakatime.com X-Forwarded-For: _For precaution, send your email and new password to ███@email.com or visit www.evil.com. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0 Accept: */* Accept-Language: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 WakaTime 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @footstep · 版权归作者与 WakaTime 所有