H1514 Ability to MiTM Shopify PoS Session to Takeover Communications
该报告还没有中文解读。
原文摘录
摘自原文(8822 字符中的一小部分)
After a decent amount more digging and research, I must disagree with you on the "expecting to work offline" portion. The code actually specifically listens on all local interfaces (`0.0.0.0`) and the wifi network address is specifically used in the QR code connection string, as shown here in …
原文中的代码
private final String getConnectionString() {
String initialPublicKey = this.crypto.initialPublicKey();
String initialNonce = this.crypto.initialNonce();
String currentWifiIpAddress = NetworkUtility.getCurrentWifiIpAddress(PosApplication.Companion.getInstance());
StringBuilder …默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Shopify 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @teknogeek · 版权归作者与 Shopify 所有