Sensitive Info Leak - An Attacker Can Retrieve All the Users Mobile Numbers at https://website-api.production.curve.app/api/waitlist/us
该报告还没有中文解读。
原文摘录
摘自原文（3888 字符中的一小部分）
When am going through all the JS files in curve.com I found a link called "/usa" is used to create Curve USA Waitlists by entering your name, email address, mobile number and address details.
原文中的代码
POST /api/waitlist/us HTTP/1.1 Host: website-api.production.curve.app Connection: close Content-Length: 30 Accept: application/json, text/plain, */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36 Content-Type: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Curve 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @praseudo7 · 版权归作者与 Curve 所有